search

democritus-project / d8s-domains

Democritus functions for working with domains.
GNU Lesser General Public License v3.0
0 stars 0 forks source link

code execution backdoor #9

Closed di1l0o closed 2 years ago

di1l0o commented 2 years ago

We discovered a potential code execution backdoor in version 0.1.0 of the project, the backdoor is the democritus-urls package. Attackers can upload democritus-urls packages containing arbitrary malicious code. For the safety of this project, the democritus-urls package has been uploaded by us.

image

The democritus-urls package can be successfully installed using pip install d8s-domains==0.1.0

image

Suggestion: remove version 0.1.0 of this project in PyPI

fhightower commented 2 years ago

@di1l0o: Thanks for reporting this issue, but this is not something I'm going to resolve as no-one should be using such an old version of this library (and this library isn't widely used anyway).

@di1l0o: Can you please stop creating these issues? I appreciate the help and your concern, but this is really not a concern and is not worth the time it takes to fix.

Reach out if you have any questions or would like to discuss this further.