61–70 of 153 posts
Earlier quoted context omitted.
Love it! Let those pip users find the compromised packages for us uv users.
Until everyone waits 7 days to install everything so the compromise is discovered on the 8th day. End result will be everyone runs COBOL only.
Am I being too nitpicky to say that that is part of your infrastructure?
Doesn't 2FA stop this attack in its tracks? PyPI supports 2FA, no?
Earlier quoted context omitted.
I really am not able to follow this line of reasoning, I am not sure if what you said makes sense and how it relates to uv having a security feature to be on average less safe :/
I believe they are saying that by the time you need something like uv, your project already has too many dependencies. Its the unnecessarily large supply chain that's the problem, and uv exists to solve a problem that you should try to avoid in the first place. I think uv is great, but I somewhat agree. We see this issue with node/npm. We need smaller supply chains/less dependencies overall, not just bandaiding over…
Is there a notification channel you can subscribe to / look at if you want to stay up to date on compromised PyPI packages?
Earlier quoted context omitted.
Love it! Let those pip users find the compromised packages for us uv users.
Until everyone waits 7 days to install everything so the compromise is discovered on the 8th day. End result will be everyone runs COBOL only.
Is there any way to setup PyPI to only publish packages that come from a certain pattern of tag that exists in GH? Would such a measure help at all here?
> The payload isn't delivered as a raw binary or a Python file. It's disguised as a .wav audio file. > The WAV file is a valid audio file. It passes MIME-type checks. But the audio frame data contains a base64-encoded payload. Decode the frames, take the first 8 bytes as the XOR key, XOR the rest, and you have your executable or Python script. Talk about burying the lede.