我知道你去年夏天进口了什么：thePython生态系统中的安全威胁研究
I Know What You Imported Last Summer: A study of security threats in thePython ecosystem
摘要：
Python的流行在过去15年中迅速上升。它是当今一些最令人兴奋的技术中的主要语言。这种流行导致了一个大型的第三方软件包生态系统，通过pip软件包注册表提供，该注册表托管超过20万个软件包。这些第三方软件包可以在安装后使用软件包管理器（如pip）简单地导入软件包来重用。第三方软件的易用性带来了安全风险，使数百万用户处于危险之中。在这个项目中，我们研究生态系统来分析这种威胁。Python的成熟生态系统有许多弱点，我们在项目中强调了这些弱点。首先，我们展示了利用Python生态系统是多么微不足道。然后，我们系统地分析软件包，维护人员和公开报告的安全问题之间的依赖关系。大多数攻击只有在用户安装恶意软件包时才可能发生。因此，我们试图分析和评估攻击者使用的不同方法，以迫使不正确的下载。我们通过估计利用流行的Python包可能造成的潜在威胁来量化您的想法。我们还讨论了行业中用于防御此类攻击的方法
英文摘要：
The popularity of Python has risen rapidly over the past 15 years. It is a major language in some of the most exciting technologies today. This popularity has led to a large ecosystem of third-party packages available via the pip package registry which hosts more than 200,000 packages. These third-party packages can be reused by simply importing the package after installing using package managers like pip. The ease of reuse of third-party software comes with security risks putting millions of users in danger. In this project, we study the ecosystem to analyze this threat. The mature ecosystem of Python has multiple weak spots that we highlight in our project. First, we demonstrate how trivial it is to exploit the Python ecosystem. Then, we systematically analyze dependencies amongst packages, maintainers, and publicly reported security issues. Most attacks are possible only if users install malicious packages. We thus try to analyze and evaluate different methods used by attackers to force incorrect downloads. We quantify your ideas by estimating the potential threat that can be caused by exploiting a popular Python package. We also discuss methods used in the industry to defend against such attacks
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
