Page 10 - Python Package Index News Today

The first-of-its-kind campaign threatens to remove code packages if developers don’t submit their code to a "validation" process.

Checkmarx has found that one in three software packages from PyPi contains a flaw that can lead to malicious content being installed.

The findings, discovered by Checkmarx and published Friday, underscore how open source software repositories like PyPi are increasingly being targeted and leveraged by malicious actors.

The scans used by the Python Package Index (PyPI) to find malware fail to catch 41% of bad packages, while creating plentiful false positives.

Just as one crop of malware-laced software packages is taken down from the popular Python code repository, a new host arrives, looking to steal a raft of data.

The discovery adds to the growing list of recent incidents where threat actors have used public code repositories to distribute malware in software supply chain attacks.

Victims are offered the decryption key without payment, but the prank demonstrates how easy such an attack can be

The malware packages had names that were common typosquats of a legitimate widely used Python library. One was downloaded hundreds of times.

Google is providing Titan Security Keys to maintainers of projects in top 1% of downloads

Welcome to the Internet-Draft/RFC author resources site