Python中如何防范PyPI上的恶意马甲包钓鱼攻击？以121.42.217.44为例
– acqusition (uploaded 2017-06-03 01:58:01, impersonates acquisition)
– apidev-coop (uploaded 2017-06-03 05:16:08, impersonates apidev-coop_cms)
– bzip (uploaded 2017-06-04 07:08:05, impersonates bz2file)
– crypt (uploaded 2017-06-03 08:03:14, impersonates crypto)
– django-server (uploaded 2017-06-02 08:22:23, impersonates django-server-guardian-api)
– pwd (uploaded 2017-06-02 13:12:33, impersonates pwdhash)
– setup-tools (uploaded 2017-06-02 08:54:44, impersonates setuptools)
– telnet (uploaded 2017-06-02 15:35:05, impersonates telnetsrvlib)
– urlib3 (uploaded 2017-06-02 07:09:29, impersonates urllib3)
– urllib (uploaded 2017-06-02 07:03:37, impersonates urllib3)
https://www.bleepingcomputer.com/news/security/ten-malicious-libraries-found-on-pypi-python-package-index/
Python中如何防范PyPI上的恶意马甲包钓鱼攻击？以121.42.217.44为例
PyPI 的包上传难度感觉人为加了难度 可能正是因为如此 所以 PyPI 的包质量通常较好 （相比 npm，上传难度很低）结果反而导致 impersonator 出现。PyPI 还有一系列 legacy 的东西没解决呢。。。
