I was checking out how to make a CTAN package, and I was surprised that it does not involve making it account: you simply have to fill out a form. If you have a new version of a package, you simply fill out the same form again.
Now, it would be a very bad idea for me to use malicious .sty files. I tend to compile my LaTeX using a Makefile, and by default I think that .sty files are allowed to change any file in the same directory, so for instance they could change it to download and run a backdoor the next time I compile my document. Surely if the author of a package I use wants to backdoor me, they will be able to. But can random third parties update other people's packages and bug me in that way?
To be more clear, here's the attack model I'm imagining.
- Mallory takes the
hyperrefpackage. This package is massive, nobody will read the full source code.
- Mallory bugs the package. In the changelog, she claims to have solved a minor bug.
- Mallory waits until the authors of hyperref go on a holiday.
- Mallory uploads the package to CTAN under the name of the original authors. CTAN has no additional verification method and will accept the package, although they may or may not send an email to the actual authors.
- The actual authors will not immediately notice that an updated version has been released.
- Many people download and use the package from CTAN. Perhaps the bugged package even gets included into LaTeX distributions.
- The actual authors come back from their holiday, and find out that their package has been updated. The backdoor was sufficiently obfuscated that the authors do not see its maliciousness, and the authors blame it on someone trying to be funny.
- The authors roll back the package update, but do not raise a stink.
- Mallory does it again to a different package to infect even more people.
For added effect and morbidity, instead of
hyperref, pick a package which is often used but whose author(s) have passed away. Upload under a pseudonym, and claim to have improved the package; CTAN might accept you as the new maintainer. If the package has been bugged in a skillful way, detection is very difficult.
For even more frightening effect, imagine the use of a package that frequently requires shell access (e.g.,
This questions seems related but not the same: CTAN Mirror Integrity - Miktex Update . That question asks if it is possible for CTAN mirrors to be bugged; I am wondering if it is possible to actively bug CTAN itself.