Telnyx package compromised on PyPI

Post by functional_dev » Sat, Mar 28, 2026, 5:32 PM UTC

woodruffw wrote: post #138

LtWorf wrote: post #136

Earlier quoted context omitted.

I'll try to reformulate in a simpler way. On debian, all builds happen without internet access. So whatever ends up on the .deb file is either contained on the dependencies or in the orig tarball. Is anything similar done for builds that create artifacts for pypi, so that a certain correspondence between binary file and sources exists? Or is there unrestricted internet access so that what actually ends up on pypi can…

That’s a nice property of centralized package management systems; I don’t think anything exactly like that exists for PyPI. The closest thing would be a cryptographic attestation. (If I wanted to taxonomize these things, I say that the Debian model is effectively a pinky promise that the source artifacts correspond to the built product, except that it’s a better pinky promise because it’s one-to-many instead of many-…

Post by throw-the-towel » Sat, Mar 28, 2026, 9:51 PM UTC

vrighter wrote: post #110

mil22 wrote: post #23

For those using uv , you can at least partially protect yourself against such attacks by adding this to your pyproject.toml : [tool.uv] exclude-newer = "7 days" or this to your ~/.config/uv/uv.toml : exclude-newer = "7 days" This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you…

if everyone waited a week, then everyb would still be installing it it the same time for the first time. This is not a solution.

Post by cozzyd » Sun, Mar 29, 2026, 1:01 AM UTC

8n4vidtmkvmk wrote: post #142

mulmen wrote: post #122

Earlier quoted context omitted.

RPM (YUM? DNF? RHEL?) lets me subscribe to security updates separately from updates. Does that concept exist in language distribution?

I don't know how it would. Hackers would just claim everything is a security update. Unless maybe you give special permission to some trusted company to designate certain releases of packages they don't own are security patches... But that sounds untenable.

Post by ashishb » Sun, Mar 29, 2026, 1:45 AM UTC

LtWorf wrote: post #117

dist-epoch wrote: post #101

Earlier quoted context omitted.

You're doing all of your software development inside containers, all the time? That is very inconvenient.

Why? Just open your entire editor/whatever inside a limited namespace and that's it no?

Post by LtWorf » Sun, Mar 29, 2026, 7:50 PM UTC

ashishb wrote: post #147

LtWorf wrote: post #117

Earlier quoted context omitted.

Why? Just open your entire editor/whatever inside a limited namespace and that's it no?

> Why? Just open your entire editor/whatever inside a limited namespace and that's it no? How will that prevent `npm run dev` or `uv run python` from accessing files outside your current directory?