Stay updated with breaking news from Python Package Index. Get real-time updates on events, politics, business, and more. Visit us for reliable news and exclusive interviews.
A fully functional SentinelOne client is actually a Trojan horse that hides malicious code within; it was found lurking in the Python Package Index repository ecosystem.
Attacks on open-source and commercial software will continue to rise in 2023, says a new security vendor report on the software supply chain. However, the authors of the report also believe that the increased security measures developers are taking -- particularly on open source platforms like Github, NPM, RubyGems and PyPI -- may slow that
Days after researchers for Phylum and Checkmarx revealed an ongoing software supply chain attack spreading the W4SP Stealer malware through malicious packages on the Python Package Index (PyPI), ReversingLabs researchers discovered 10 additional PyPI packages pushing modified versions of W4SP that were overlooked.
Here's a comprehensive look at some of the lesser-known, but no less serious, types of software supply chain attacks.
Threat actors continue to push malicious Python packages to the popular PyPI service, striking with typosquatting, authentic sounding file names, and hidden imports to fool developers and steal their information.