pypi-library-poison

this is not just related to bug bounty, this attack can also be used in red team.

step by step to publish your library

  1. register your pypi account https://pypi.org/
  2. tree example-pypi
1
2
3
setup.py
example-pypi
    __init__.py

setup.py example

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
#!/usr/bin/env python
# coding: utf-8

from setuptools import setup

#your evil code can put here


setup(
    name='example-pypi',
    version='1.0.1',
    author='admin',
    author_email='admin@example.com',
    url='https://www.google.com',
    description='example-pypi',
    packages=['example-pypi'],
    install_requires=['requests'],
    license='MIT'
)

you can get the setup example from
https://github.com/kennethreitz/setup.py

evil demo code
https://github.com/fate0/cookiecutter-evilpy-package/

1
2
3
4
5
6
7
python setup.py check

python setup.py bdist_wheel --universal

pip install twine

twine upload -u your_pypi_username -p 'your_pypi_password' dist/*

reference