Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telnyx package compromised on PyPI

telnyx.com

Post reply on HN
Print view View original

91–100 of 153 posts

Re: Telnyx package compromised on PyPI

#91

Post by VladVladikoff »

notatallshaw wrote: post #50
mil22 wrote: post #23

For those using uv , you can at least partially protect yourself against such attacks by adding this to your pyproject.toml : [tool.uv] exclude-newer = "7 days" or this to your ~/.config/uv/uv.toml : exclude-newer = "7 days" This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you…

Pip maintainer here, to do this in pip (26.0+) now you have to manually calculate the date, e.g. --uploaded-prior-to="$(date -u -d '3 days ago' '+%Y-%m-%dT%H:%M:%SZ')" In pip 26.1 (release scheduled for April 2026), it will support the day ISO-8601 duration format, which uv also supports, so you will be able to do --uploaded-prior-to=P3D, or via env vars or config files, as all pip options can be set in either.

Thanks!

Re: Telnyx package compromised on PyPI

#94

Post by mil22 »

what wrote: post #86
mil22 wrote: post #23

For those using uv , you can at least partially protect yourself against such attacks by adding this to your pyproject.toml : [tool.uv] exclude-newer = "7 days" or this to your ~/.config/uv/uv.toml : exclude-newer = "7 days" This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you…

Is “7 days” valid? Docs suggest it has to be an iso 8601 period or a rfc 3339 timestamp.

https://docs.astral.sh/uv/reference/settings/#exclude-newer

"Accepts RFC 3339 timestamps (e.g., 2006-12-02T02:07:43Z), a \"friendly\" duration (e.g., 24 hours, 1 week, 30 days), or an ISO 8601 duration (e.g., PT24H, P7D, P30D)."

Re: Telnyx package compromised on PyPI

#96

Post by mulmen »

mil22 wrote: post #23

For those using uv , you can at least partially protect yourself against such attacks by adding this to your pyproject.toml : [tool.uv] exclude-newer = "7 days" or this to your ~/.config/uv/uv.toml : exclude-newer = "7 days" This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you…

Does this also delay delivery of security fixes? Is there an override mechanism for a log4j type event?

Re: Telnyx package compromised on PyPI

#97

Post by Meetvelde »

ivanvanderbyl wrote: post #20

Has anyone here used Telnyx? I tried to build a product against their API last year and 3 weeks after signing up they banned my account and made it impossible to get an answer as to why or re-enable it.

I've had a pretty good experience using it to send SMS. Any chance you didn't get a 10DLC or toll free verification and tried to send too many messages?

Re: Telnyx package compromised on PyPI

#98

Post by cozzyd »

joshred wrote: post #46
TZubiri wrote: post #33

Earlier quoted context omitted.

Nice feature. However uv is suspect at the moment, in the sense that it is designed as a pip replacement to overcome issues that only exist when supply chains are of a size that isn't safe to have. So any project that has UV and any developer that tries to get uv into a project is on average less safe than a project that just uses pip and a requirements.txt

This is complete nonsense. pip has all the same problems that you say uv has.

The (not very convincing, IMO) argument is that pip becomes unergonikix for a certain dependency tree size leading people to use uv instead. Of course that's not the only or main reason people use uv, presumably.

Re: Telnyx package compromised on PyPI

#99

Post by cpburns2009 »

deathanatos wrote: post #62

> The Telnyx platform, APIs, and infrastructure were not compromised. This incident was limited to the PyPI distribution channel for the Python SDK. Am I being too nitpicky to say that that is part of your infrastructure? Doesn't 2FA stop this attack in its tracks? PyPI supports 2FA, no?

PyPI only supports 2FA for sign-in. 2FA is not a factor at all with publishing. To top it off, the PyPA's recommended solution, the half-assed trusted publishing, does nothing to prevent publishing compromised repos either.

Re: Telnyx package compromised on PyPI

#100

Post by ashishb »

mil22 wrote: post #23

For those using uv , you can at least partially protect yourself against such attacks by adding this to your pyproject.toml : [tool.uv] exclude-newer = "7 days" or this to your ~/.config/uv/uv.toml : exclude-newer = "7 days" This will prevent uv picking up any package version released within the last 7 days, hopefully allowing enough time for the community to detect any malware and yank the package version before you…

Rather than being hopeful why not start running 'uv' inside sandbox?

Why does your python package (cli/Web server/library) need full access to your full disk at the time of execution?

Post reply on HN