search

joeyism / linkedin_scraper

A library that scrapes Linkedin for user data
GNU General Public License v3.0
1.86k stars 527 forks source link

code execution backdoor #124

Open di1l0o opened 2 years ago

di1l0o commented 2 years ago

We found a malicious backdoor in versions 2.0.0~2.5.0 of this project, and its malicious backdoor is the request package. Even if the request package was removed by pypi, many mirror sites did not completely delete this package, so it could still be installed.When using pip3 install linkedin-scraper==2.5.0 -i http://pypi.doubanio.com/simple --trusted-host pypi.doubanio.com, the request malicious plugin can be successfully installed.

image

image

Repair suggestion: delete version 2.0.0~2.5.0 in PyPI

di1l0o commented 2 years ago

linkedin-scraper in PyPI: https://pypi.org/project/linkedin-scraper/