“PyPI Downtime Sparks Concerns Over Package Distribution Resilience”

Python Package Index Repository Back Up and Running After Temporary Suspension

The Python Package Index (PyPI) repository is back up and running after a temporary suspension of all new users and package uploads. PyPI is the official software repository for Python, serving over 700,000 users and over 450,000 projects. Its popularity has attracted not just developers but hackers who like to upload malicious packages as a first step in supply chain breaches. The site was taken offline temporarily due to a volume of malicious users and projects being created, which outpaced the ability of the PyPI administrators to respond to it in a timely fashion. PyPI suspended new user and project registrations, beginning on Saturday afternoon (UTC). The statement raised concerns within the security community, with many news sites reporting the site as falling victim to an anomalous wave of malicious activity or even an outright cyberattack. However, Ee Durbin, Director of Infrastructure for the Python Software Foundation, told Dark Reading that there was no unusual glut, simply fewer people than usual to address the usual glut. He explained that the weekend shutdown was just a matter of human capacity.

The Growing Concerns around Open Source Security

Open-source software repositories have become a major concern for many organizations in recent years due to increasing fears around the state of open source security. Peter Morgan, Co-Founder and CSO of Phylum, stated that the number of attacks skyrocketed over the last two years. In the first quarter of 2023, Phylum analyzed 2.8 million packages published to popular repositories like PyPI, npm, and Nuget, 18,016 of which executed suspicious code upon installation, 6,099 referenced known malicious URLs, and 2,189 targeted specific organizations. Malicious packages are so rampant today that some hackers hardly feel the need to hide them anymore. They realize how easy it is to download scripts off the Internet to pollute the open-source supply chain. It’s costless, and they can do it for free with anonymous accounts. The defender has a massive disadvantage here as the attacker only has to win once.

The Need for Better Package Inspection and Development of New Tools

Organizations that utilize open-source software, which is to say all organizations, have a much harder time defending against these low-level attackers. There are so many dependencies, and all an attacker has to do is get one foot in the dependency chain to get a hold in your computer. Because of these vulnerabilities, there are calls for better package inspection, the development of new tools to track dependencies, and software bills of materials (SBOMs). PyPI and other repositories have struggled to keep up with their far more numerous adversaries. To assuage concerns, Durbin indicates that there are exciting developments that will allow for much more sustainable and potentially automated handling of malware reports coming soon. The Python Software Foundation has recently added a security developer-in-residence role to improve Python security at large. Furthermore, PyPI will hire a safety and security engineer whose job will focus on PyPI‘s security in particular. Supply chain security in the years to come will turn on our ability to keep public repos clean and protect ourselves when they’re not. Software vulnerabilities are not what attackers are using to break into computers today; they’re creating malicious packages.

Editorial and Advice

The recent temporary shutdown of PyPI has highlighted the need for better security measures to protect open-source software repositories from falling into the wrong hands. It is critical that users exercise caution when installing from a public index and keep their software up to date. They should pay particular attention to package dependencies and ensure that any vulnerabilities are addressed promptly. Developers should commit to the development of new tools to track dependencies, such as software bills of materials. Moreover, repositories should continue to upgrade their security measures and automate handling of malware reports. These steps are critical to maintaining public repos clean and defending against attackers seeking to wreak havoc on our systems.