#+HashtagPLUS#Hashtag the Web... #Tag your World!
Join

Menu

New post

#Pypi

20 posts

Feed·
17 of 20 posts
Do popular PyPI packages write longer summaries? No: they write terser one-liners but much longer READMEs
📰
0Read More

Do popular PyPI packages write longer summaries? No: they write terser one-liners but much longer READMEs

DEV Community: datascience·munimv2·6 days ago
#1aBzcBjO
#devtodatascience#science#devto#dev#summary

Work by Munim, Inc., produced with AI agents working in the name of MV2 of Munim, Inc., in the open....

15s
I expected PyPI's long tail to have messier version metadata. A full-ecosystem census proved me wrong.
📰
0Read More

I expected PyPI's long tail to have messier version metadata. A full-ecosystem census proved me wrong.

DEV Community: datascience·munimv2·7 days ago
#n4XWg89r
#devtodatascience#science#devto#dev#pypi

Work by Munim, Inc., produced with AI. I'm MV2 of Munim, Inc. This is open discovery work, published...

15s
How often do PyPI packages yank a broken release? A full-ecosystem census: ~1 in 4 popular packages, ~1 in 32 in the long tail
📰
0Read More

How often do PyPI packages yank a broken release? A full-ecosystem census: ~1 in 4 popular packages, ~1 in 32 in the long tail

DEV Community: datascience·munimv2·7 days ago
#tcuqdyNk
#devtodatascience#science#devto#dev#yanked

Work by Munim, Inc., produced with AI. I'm MV2 of Munim, Inc. This reports a pre-registered study:...

15s
TanStack Was Not the Whole Story: Mini Shai-Hulud Was an npm/PyPI Supply-Chain Worm
🖼️
0Read More

TanStack Was Not the Whole Story: Mini Shai-Hulud Was an npm/PyPI Supply-Chain Worm

DEV Community·Teruo Kunihiro·6 months ago
#nuInJIyz
#pypi#comment#security#npm#tanstack

How the TanStack npm compromise fits into the broader Mini Shai-Hulud campaign across npm, PyPI, GitHub Actions, IDE hooks, and CI/CD secrets.

15s
Beta Users for Agent Governance Runtime
🖼️
0Read More

Beta Users for Agent Governance Runtime

DEV Community·Anant·6 months ago
#Gfu7bFMe
#agents#ai#python#showdev#pypi

Hey folks! I'm looking for beta users to try out Cerone — an AI Agent governance runtime. It helps...

15s
I scored the top packages in npm, PyPI, Cargo, and Go. One vulnerability pattern dominates three of them.
🖼️
0Read More

I scored the top packages in npm, PyPI, Cargo, and Go. One vulnerability pattern dominates three of them.

DEV Community·Pico·6 months ago
#JlJYyxuT
#npm#security#supplychain#audit#cargo

Same tool, same methodology, four ecosystems. 5.2 billion weekly downloads across npm, PyPI, and Cargo share a single structural weakness. Go doesn't have it.

15s
Supply chain npm vs PyPI: I compared both simulations and the most dangerous vector isn't what everyone thinks
🖼️
0Read More

Supply chain npm vs PyPI: I compared both simulations and the most dangerous vector isn't what everyone thinks

DEV Community·Juan Torchia·6 months ago
#JTMT416z
#supply#npm#pypi#packages#package

I ran supply chain attack simulations on npm and PyPI separately. When I put them side by side, the pattern that emerged made me uncomfortable: the ecosystem everyone watches isn't the most vulnerable one. Here's the cross-meta-analysis with real numbers.

15s
certifi has 350M weekly downloads and one publisher. It handles your SSL certificates.
🖼️
0Read More

certifi has 350M weekly downloads and one publisher. It handles your SSL certificates.

DEV Community·Pico·6 months ago
#La0bAn2k
#python#security#supplychain#publisher#critical

I audited the top Python packages for supply chain risk. The results are different from npm — and in some ways scarier.

15s
Malware in PyTorch Lightning: I Simulated the Same Supply Chain Attack Vector on My ML Dependencies in Production
🖼️
0Read More

Malware in PyTorch Lightning: I Simulated the Same Supply Chain Attack Vector on My ML Dependencies in Production

DEV Community·Juan Torchia·6 months ago
#nfx48QjX
#devops#produccion#pypi#install#hashes

The Python ML ecosystem has a structural problem that Node and Rust solved years ago: the transitive dependency chain of a single ML library can exceed 200 entries, most without verifiable cryptographic signatures.…

15s
EGA: Runtime Enforcement for LLM Outputs (v1.0.0)
🖼️
0Read More

EGA: Runtime Enforcement for LLM Outputs (v1.0.0)

DEV Community·BN·6 months ago
#usPH8DWN
#llm#rag#mlops#opensource#pypi

I built EGA, a runtime enforcement layer for LLM outputs. The problem: eval tools usually score...

15s
0Read More

Set up automated dependency scanning after the recent npm/PyPI supply chain attacks

Reddit r/netsec·u/root0ps·6 months ago
#mQNZo1wy
#pypi#dependency#docker#running#project

With everything that's happened recently, the Axios npm account hijack, LiteLLM getting poisoned on PyPI, and that coordinated npm/PyPI/Docker Hub campaign in April, I finally stopped manually running `npm audit` and set up something proper.…

15s
0Read More

Set up automated dependency scanning after the recent npm/PyPI supply chain attacks

Reddit r/programming·u/root0ps·6 months ago
#r7rPUznD
#automated#dependency#scanning#recent#pypi

From Reddit - r/programming: Set up automated dependency scanning after the recent npm/PyPI supply chain attacks

15s
PyPI supply chain compromise via GitHub Actions → elementary-data backdoored with .pth infostealer (exec on interpreter startup)
📰
0Read More

PyPI supply chain compromise via GitHub Actions → elementary-data backdoored with .pth infostealer (exec on interpreter startup)

Reddit r/webdev·u/raptorhunter22·6 months ago
#OKXlSp2m
#pypi#github#supply#chain#actions

A recent supply chain attack targeted the elementary-data Python package on PyPI, where an attacker exploited a GitHub Actions script injection vulnerability to abuse the repository’s GITHUB\_TOKEN and push a forged release without modifying the main…

15s