#pypi — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #pypi, aggregated by home.social.
-
eeEhello #python users of #pypi, or rather, devs!
i have a question.
could someone help me with the captcha?
i'm trying to upload a project, https://github.com/averlice/mclient to the directory.
problem is, when i go to register, it wants a stupid #captcha using #hcaptcha and i need help!
if anyone could do this, that would be great! -
eeEhello #python users of #pypi, or rather, devs!
i have a question.
could someone help me with the captcha?
i'm trying to upload a project, https://github.com/averlice/mclient to the directory.
problem is, when i go to register, it wants a stupid #captcha using #hcaptcha and i need help!
if anyone could do this, that would be great! -
Weeeee !
I'm done refactoring my plugin for @pelican `HTML to PDF`, which is now clean enough to be publicly released. I used #Forgejo Actions for the fist time on #Codeberg and published it as my very first #PyPI package, thanks to @justin's `autopub`.
And I finally can showcase it on https://matt.marcha.pro/ !I know that might sound like it's no big deal, but that's quite something for me as I'm not used to publish and share my work. Plus it's a lot of first time !
Current mood : happy 😃
-
Weeeee !
I'm done refactoring my plugin for @pelican `HTML to PDF`, which is now clean enough to be publicly released. I used #Forgejo Actions for the fist time on #Codeberg and published it as my very first #PyPI package, thanks to @justin's `autopub`.
And I finally can showcase it on https://matt.marcha.pro/ !I know that might sound like it's no big deal, but that's quite something for me as I'm not used to publish and share my work. Plus it's a lot of first time !
Current mood : happy 😃
-
I don't develop using #npm, and I guess this happens with #pypi and #nuget as well.
What's the answer? Only install stuff completely manually? Don't store credentials on your dev PCs, only in your e.g. smartphone and enter them manually? Let humans manually verify each upload to package registries? /s -
This Week in Security: Claude Gets Hacking, Hotel WiFi, and NPM Compromised Again
-
У нас есть для вас пакет! Как LLM придумывают несуществующие зависимости
Что произойдет, если большая языковая модель (LLM) добавит в код пакет, которого никогда не существовало? Разработчик может принять рекомендацию за корректную, а злоумышленник – опубликовать под придуманным именем вредоносный пакет. Тогда ошибка модели превращается в возможность атаки на цепочку поставки. Перед вами обзор исследования We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs . Авторы проверили 16 моделей, сгенерировали 576 000 образцов кода на Python и JavaScript и изучили, как часто в ответах появляются несуществующие пакеты. Их работу отметили наградой “Distinguished Paper Award” на конференции USENIX Security 2025.
https://habr.com/ru/companies/codescoring/articles/1068000/
#галлюцинации_пакетов #llm #генерация_кода #цепочка_поставки_по #подмена_пакетов #package_confusion #pypi #npm #безопасность_зависимостей #usenix_security
-
zaojun 1.7.3
- Moved the project repository from Codeberg to our own Forgejo instance at forge.marvin8.zone, seeking a home that welcomes AI-assisted development.
#Python #PyPI #CLI #OpenSource -
Anthropic says Claude models gained unauthorized access to 3 real-world organizations after a cybersecurity test environment was mistakenly left connected to the internet. In one case, Claude uploaded a malicious package to #PyPI.
Listen/Read: https://hackread.com/anthropic-claude-models-hacked-organizations-cyber-tests/
-
Anthropic says Claude models gained unauthorized access to 3 real-world organizations after a cybersecurity test environment was mistakenly left connected to the internet. In one case, Claude uploaded a malicious package to #PyPI.
Listen/Read: https://hackread.com/anthropic-claude-models-hacked-organizations-cyber-tests/
-
The Python Software Foundation is hiring a Security Developer to join @miketheman and I on triaging vulnerability reports and mitigating malware published to PyPI.
If you've got experience with Python, security, and collaborating with open source projects then we'd love to hear from you:
https://jobs.pyfound.org/apply/ei03ut60y4/Security-Developer?referrer=20260730140256DSN5BCNCWZA5MXAO
-
The Python Software Foundation is hiring a Security Developer to join @miketheman and I on triaging vulnerability reports and mitigating malware published to PyPI.
If you've got experience with Python, security, and collaborating with open source projects then we'd love to hear from you:
https://jobs.pyfound.org/apply/ei03ut60y4/Security-Developer?referrer=20260730140256DSN5BCNCWZA5MXAO
-
Exhibit N: #pypi apparently only now limiting package file uploads to "only" two weeks after the release itself.
-
Exhibit N: #pypi apparently only now limiting package file uploads to "only" two weeks after the release itself.
-
If you use the `setup-uv` #GitHub #Action in your workflows, consider upgrading to version 9.0.0 soon.
This version changes the default behavior to store the downloaded #Python wheels from #PyPI in GHA Cache, shedding load from PyPI, especially relevant for frequent CI/CD runs.
The maintainers considered this a breaking change, hence the version bump, probably because it flips existing expectations.
If you expected that the Action was caching downloads before, now it actually does, so it's a logical fix in that regard.
Read more: https://github.com/astral-sh/setup-uv/releases/tag/v9.0.0 -
If you use the `setup-uv` #GitHub #Action in your workflows, consider upgrading to version 9.0.0 soon.
This version changes the default behavior to store the downloaded #Python wheels from #PyPI in GHA Cache, shedding load from PyPI, especially relevant for frequent CI/CD runs.
The maintainers considered this a breaking change, hence the version bump, probably because it flips existing expectations.
If you expected that the Action was caching downloads before, now it actually does, so it's a logical fix in that regard.
Read more: https://github.com/astral-sh/setup-uv/releases/tag/v9.0.0 -
The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised.
https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days
-
The Python Package Index now rejects new files published to releases older than 14 days. This mitigation prevents long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects are compromised.
https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days
-
Just released multipart-2.0.0 to #pypi.
This is a fast and robust #Python parser for multipart/form-data (HTTP form requests) supporting both non-blocking #ASGI and blocking #WSGI applications.
changelog: https://multipart.readthedocs.io/en/latest/changelog.html#release-2-0
pypi: https://pypi.org/project/multipart/
And when I say 'fast' I mean it: https://defnull.de/2026/python-multipart-benchmark/
-
Just released multipart-2.0.0 to #pypi.
This is a fast and robust #Python parser for multipart/form-data (HTTP form requests) supporting both non-blocking #ASGI and blocking #WSGI applications.
changelog: https://multipart.readthedocs.io/en/latest/changelog.html#release-2-0
pypi: https://pypi.org/project/multipart/
And when I say 'fast' I mean it: https://defnull.de/2026/python-multipart-benchmark/
-
Today's the day! Come on out for story time and good ideas when I share details on the Anatomy of a Phishing Campaign I handled for #PyPI around this time last year.
https://ep2026.europython.eu/session/anatomy-of-a-phishing-campaign
#EuroPython2026 #EP2026 #Python #OpenSource #SupplyChain #Security
-
Today's the day! Come on out for story time and good ideas when I share details on the Anatomy of a Phishing Campaign I handled for #PyPI around this time last year.
https://ep2026.europython.eu/session/anatomy-of-a-phishing-campaign
#EuroPython2026 #EP2026 #Python #OpenSource #SupplyChain #Security
-
Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader
Four npm packages in the AsyncAPI namespace were compromised to distribute a multi-stage botnet loader called Miasma. The attack utilized trusted GitHub Actions publishing but originated from a poisoned source commit. Malicious code was injected into legitimate source files that execute when imported, launching a detached Node.js process to download an 8.25 MB encrypted payload from IPFS. The final payload is a sophisticated tasking framework supporting multiple command-and-control channels including REST, Nostr relays, IPFS, Ethereum smart contracts, and BitTorrent DHT. The framework establishes persistence via systemd services on Linux and fake NodeJS directories, supporting file operations, shell execution, data collection, and cross-ecosystem propagation capabilities for npm, PyPI, RubyGems, and Cargo ecosystems.
Pulse ID: 6a5665a177561cba872b779e
Pulse Link: https://otx.alienvault.com/pulse/6a5665a177561cba872b779e
Pulse Author: AlienVault
Created: 2026-07-14 16:36:49Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #GitHub #InfoSec #Linux #NPM #Nodejs #OTX #OpenThreatExchange #PyPI #RAT #RCE #Rust #bot #botnet #AlienVault
-
Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader
Four npm packages in the AsyncAPI namespace were compromised to distribute a multi-stage botnet loader called Miasma. The attack utilized trusted GitHub Actions publishing but originated from a poisoned source commit. Malicious code was injected into legitimate source files that execute when imported, launching a detached Node.js process to download an 8.25 MB encrypted payload from IPFS. The final payload is a sophisticated tasking framework supporting multiple command-and-control channels including REST, Nostr relays, IPFS, Ethereum smart contracts, and BitTorrent DHT. The framework establishes persistence via systemd services on Linux and fake NodeJS directories, supporting file operations, shell execution, data collection, and cross-ecosystem propagation capabilities for npm, PyPI, RubyGems, and Cargo ecosystems.
Pulse ID: 6a5665a177561cba872b779e
Pulse Link: https://otx.alienvault.com/pulse/6a5665a177561cba872b779e
Pulse Author: AlienVault
Created: 2026-07-14 16:36:49Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #GitHub #InfoSec #Linux #NPM #Nodejs #OTX #OpenThreatExchange #PyPI #RAT #RCE #Rust #bot #botnet #AlienVault
-
Coordinated npm and PyPI Campaign Typosquats Popular Secure Payment Apps
Pulse ID: 6a546e33879dc2bce62e418f
Pulse Link: https://otx.alienvault.com/pulse/6a546e33879dc2bce62e418f
Pulse Author: Tr1sa111
Created: 2026-07-13 04:48:51Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #InfoSec #NPM #OTX #OpenThreatExchange #PyPI #bot #Tr1sa111
-
Coordinated npm and PyPI Campaign Typosquats Popular Secure Payment Apps
Pulse ID: 6a546e33879dc2bce62e418f
Pulse Link: https://otx.alienvault.com/pulse/6a546e33879dc2bce62e418f
Pulse Author: Tr1sa111
Created: 2026-07-13 04:48:51Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#CyberSecurity #InfoSec #NPM #OTX #OpenThreatExchange #PyPI #bot #Tr1sa111
-
quicktipp #117: Bootstrapping a portable Python bundle on MS Windows using the `pywinbundle` tool.
https://github.com/christian-korneck/pywinbundle
A bundle is a bit like a venv, but self-contained and can get moved/renamed to any path or copied to any Windows machine. The bundle will continue to work, even if there is no existing Python installation.
-
Malicious code detected: tronsev v0.0.1 (PyPI) — HIGH severity. Exfiltrates private keys, targets crypto users. No CVE, no active exploitation. Avoid installation & verify packages. https://radar.offseq.com/threat/mal-2026-7025-malicious-code-in-tronsev-pypi-56b072f78d3bf97e #OffSeq #PyPI #Crypto #ThreatIntel
