PyPi package 'fabrice', typosqatting 'fabric', has been stealing AWS keys since 2021.
https://www.techradar.com/pro/security/aws-keys-stolen-by-malicious-pypi-package-with-thousands-of-downloads
#CoSoSec #cybersecurity
Follow
@peterquirk pypi is making me very nervous. I know they do a lot of vetting but yikes.
@peterquirk @b4cks4w shared this at work in our python channel where people were just last week walking about PyPi ... I'm hoping the lack of response is due to people currently pouring through code making sure they didn't make this mistake.
@b4cks4w Exactly! We need an all-of-government effort to secure it.