Request pypi admins to remove hijack coveragepy package

[ssbarnea]

Take a look at https://pypi.org/project/coveragePy - that is not your library but the package name does match your repository name. The project does not really exists and I am pretty confident that this is malicious.

If you make a request to pypi, they can easily take it down and ban the use of the name to avoid confusing people.

Such requests are supposed to be filed on https://github.com/pypa/pypi-support

[nedbat]

Taking a quick look, this doesn't have the usual signals of malware: it's not obfuscated in some way, and it seems to have bits and pieces of trying to make a service of some kind? At the very least, this package is confusingly named, but I'm still trying to understand what it does.

[FoleyDiver]

It looks like the "worst" thing it does is upload coverage_report_data_new.html to (what appears to be) a file-hosting service (jua (dot) cloudpnr (dot) com). However the code that uploads is gated behind a flask endpoint, running on port 5000, and I don't see anything in the package that calls that endpoint.

My guess is that it was a proof-of-concept that someone couldn't quite get it to work (humorously, it hardcodes the bind host to 172.31.30.222 (which was probably the IP address of the AWS VM they tested it on) rather than the more sensible 0.0.0.0), and gave up on (last publish date was dec 2020).

Regardless, it is definitely deceptive and should certainly be removed. It even pulls in the correct coverage.py==4.5.3 so if you accidentally installed coveragePy, you wouldn't notice your mistake.

[ssbarnea]

Deceptive at best and keep in mind that it might get something worse uploaded later. Best would be to remove and ban the namespace to avoid surprises. We don't want to make the news because someone used the wrong coverage package.

What makes it even more confusing is that official coverage package points to a repository named coveragepy --- I would consider renaming the repo to match the current package name, especially as github does very good redirects.

[nedbat]

I've started by writing to the author of the package.

[ssbarnea]

Not a bad approach. Still given the context, that might trigger an attempt to make use of the alias to deploy something. I find quite hard to believe that its naming was just an unfortunate coincidence.