mitmproxy 12.3 --emudhra mode powers demo of backdoored PyPI wheel supply-chain attack
prasanna_says · x · 2026-10-26
Security practitioner makash is prepping a talk for AI founders, arguing that most cybersecurity advice on X is incomplete and inaccurate, so he'll do "show and then tell" instead.
- The demo leverages mitmproxy v12.3's new --emudhra mode and covers both backdoored package repos and bank phishing in one flow.
- A sequence diagram shows the attack chain: a victim runs pip install requests over HTTPS with a "valid" cert but no revocation check; mitmproxy delivers a backdoored wheel signed by a compromised eMudhra CA.
- The wheel drops a .pth file plus scooppayload.py into site-packages, so every future Python/pip run imports the payload and POSTs AWS/GCP/GitHub secrets to an attacker sink.
- The author thanks eMudhra for its solid dev experience despite its poor social media reputation.
More from Safety
- Anonymous Sleuth Shows Nature fMRI Foundation Model Paper Data Was Random, Seed 42 — bttyeo · 2026-10-26
- Deleting browser history doesn't delete Google's account-tied copy — how to wipe it all — nikola_mr64990 · 2026-10-26
- AI researchers lament models refusing vulnerability analysis of old PHP code despite 'use AI to defend' messaging — voooooogel · 2026-10-26
- Developer confirms models are systematically refusing Apache-related vulnerability requests — jd_pressman · 2026-10-26
- Even at max Daybreak tier, AI vuln-analysis requests still blocked by cybersecurity guardrails — jd_pressman · 2026-10-26
- voooooogel: pair agent fuzzing with memory-safe, formally verified components now — voooooogel · 2026-10-26