search

dmlc / gluon-cv

Gluon CV Toolkit
http://gluon-cv.mxnet.io
Apache License 2.0
5.84k stars 1.22k forks source link

code execution backdoor #1746

Closed di1l0o closed 2 years ago

di1l0o commented 2 years ago

We found a malicious backdoor in versions 0.0.0~0.0.5 of this project, and its malicious backdoor is the request package. Even if the request package was removed by pypi, many mirror sites did not completely delete this package, so it could still be installed.When using pip3 install gluoncv-torch -i http://pypi.doubanio.com/simple --trusted-host pypi.doubanio.com, the request malicious plugin can be successfully installed.

8fc6300ef49c6c1cdaaa5a9a2ae92c8

Repair suggestion: delete version 0.0.0~0.0.5 in PyPI, replace request with requests

github-actions[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.