This article provides a comprehensive analysis of how malicious Python packages can execute arbitrary code during installation and runtime, categorizing techniques into build hook abuses (setup.py command classes, .pth files, site hooks, PYTHONPATH manipulation) and package content abuses (init.py, main.py, entry point hijacking, package overriding). Each technique is assessed for persistence, OS support, and distribution compatibility. The article highlights that developers are high-value targets due to administrative access to sensitive assets, and that payload execution can occur within minutes of package installation with exfiltration within an hour.
persistence techniques
1 post
The serpent’s tongue: Luring the Python out of its den