#+HashtagPLUS
In

Menu

#Pypi

17 posts

Feed·
15 of 17 posts
TanStack Was Not the Whole Story: Mini Shai-Hulud Was an npm/PyPI Supply-Chain Worm
🖼️
0

TanStack Was Not the Whole Story: Mini Shai-Hulud Was an npm/PyPI Supply-Chain Worm

DEV Community·Teruo Kunihiro·20 days ago
#nuInJIyz
#pypi#comment#security#npm#tanstack#github

How the TanStack npm compromise fits into the broader Mini Shai-Hulud campaign across npm, PyPI, GitHub Actions, IDE hooks, and CI/CD secrets.

15s
Read More
I scored the top packages in npm, PyPI, Cargo, and Go. One vulnerability pattern dominates three of them.
🖼️
0

I scored the top packages in npm, PyPI, Cargo, and Go. One vulnerability pattern dominates three of them.

DEV Community·Pico·23 days ago
#JlJYyxuT
#npm#security#supplychain#audit#cargo#proof

Same tool, same methodology, four ecosystems. 5.2 billion weekly downloads across npm, PyPI, and Cargo share a single structural weakness. Go doesn't have it.

15s
Read More
Supply chain npm vs PyPI: I compared both simulations and the most dangerous vector isn't what everyone thinks
🖼️
0

Supply chain npm vs PyPI: I compared both simulations and the most dangerous vector isn't what everyone thinks

DEV Community·Juan Torchia·24 days ago
#JTMT416z
#supply#npm#pypi#packages#package#install

I ran supply chain attack simulations on npm and PyPI separately. When I put them side by side, the pattern that emerged made me uncomfortable: the ecosystem everyone watches isn't the most vulnerable one. Here's the cross-meta-analysis with real numbers.

15s
Read More
Malware in PyTorch Lightning: I Simulated the Same Supply Chain Attack Vector on My ML Dependencies in Production
🖼️
0

Malware in PyTorch Lightning: I Simulated the Same Supply Chain Attack Vector on My ML Dependencies in Production

DEV Community·Juan Torchia·about 1 month ago
#nfx48QjX
#devops#produccion#pypi#install#hashes#production

The Python ML ecosystem has a structural problem that Node and Rust solved years ago: the transitive dependency chain of a single ML library can exceed 200 entries, most without verifiable cryptographic signatures.…

15s
Read More
EGA: Runtime Enforcement for LLM Outputs (v1.0.0)
🖼️
0

EGA: Runtime Enforcement for LLM Outputs (v1.0.0)

DEV Community·BN·about 1 month ago
#usPH8DWN
#llm#rag#mlops#opensource#pypi#runtime

I built EGA, a runtime enforcement layer for LLM outputs. The problem: eval tools usually score...

15s
Read More
📰
0

Set up automated dependency scanning after the recent npm/PyPI supply chain attacks

Reddit r/netsec·u/root0ps·about 1 month ago
#mQNZo1wy
#pypi#dependency#docker#running#project#article

With everything that's happened recently, the Axios npm account hijack, LiteLLM getting poisoned on PyPI, and that coordinated npm/PyPI/Docker Hub campaign in April, I finally stopped manually running `npm audit` and set up something proper.…

15s
Read More
PyPI supply chain compromise via GitHub Actions → elementary-data backdoored with .pth infostealer (exec on interpreter startup)
📰
0

PyPI supply chain compromise via GitHub Actions → elementary-data backdoored with .pth infostealer (exec on interpreter startup)

Reddit r/webdev·u/raptorhunter22·about 1 month ago
#OKXlSp2m
#pypi#github#supply#chain#actions#article

A recent supply chain attack targeted the elementary-data Python package on PyPI, where an attacker exploited a GitHub Actions script injection vulnerability to abuse the repository’s GITHUB\_TOKEN and push a forged release without modifying the main…

15s
Read More