home.social

#pypi — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #pypi, aggregated by home.social.

  1. Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.

    Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.

    gitweb.gentoo.org/proj/mgorny-

    #Gentoo

  2. Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.

    Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.

    gitweb.gentoo.org/proj/mgorny-

    #Gentoo

  3. Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.

    Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.

    gitweb.gentoo.org/proj/mgorny-

    #Gentoo

  4. Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.

    Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.

    gitweb.gentoo.org/proj/mgorny-

    #Gentoo

  5. Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.

    Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.

    gitweb.gentoo.org/proj/mgorny-

    #Gentoo

  6. 🕵🏻‍♂️ [InfoSec MASHUP] 21/2026 - The Supply Chain Didn't Break. It Was Walked.

    This week's issue reads like a case study in cascade failure. A malicious VS Code extension on one #GitHub employee's device leads to 3,800 internal repositories exfiltrated — by #TeamPCP, the same group that poisoned 170 npm and #PyPI packages last week. #Grafana gets breached via a token nobody rotated after the TanStack attack, itself a TeamPCP operation. A GitHub Action used by thousands of projects gets compromised and starts exfiltrating CI/CD credentials. And somewhere in a public GitHub spreadsheet, CISA contractor credentials — including #AWS GovCloud keys — sat waiting to be found.

    These aren't four separate incidents. They're one incident with four manifestations. The supply chain isn't a vector anymore; it's the terrain. Developer tooling, CI/CD pipelines, third-party actions, tokens issued and forgotten — all of it is now actively mapped and exploited with a persistence that makes the traditional "patch and move on" response look quaint. The Verizon DBIR dropped this week noting that third-party compromise is surging. The week's news was already illustrating the point before the report landed.

    → Week #21/2026 also covers: fast16 predated #Stuxnet and corrupted nuclear simulations quietly, #Pwn2Own Berlin paid $1.3M for 47 bugs, and #Bluesky got hijacked for Russian propaganda.

    Full issue 👉 infosec-mashup.santolaria.net/

    If you find it useful, subscribe to get it in your inbox every weekend 📨 #infosecMASHUP #cybersecurity #infosec #threatintel #AI

  7. Released v1.3.3. of #Yaralyzer, my surprisingly popular tool for visualizing YARA rule matches with colors (a lot of colors).

    1. --export-png images lets you export images of the analysis

    2. almost all command line options (including multi argument ones like --yara-rules-dir) can be permanently set via environment variables or .yaralyzer file

    3. couple of small bug fixes and debugging related command line options

    You can try it on the web here: yaratoolkit.securitybreak.io/
    (I didn't build this website, Thomas Roccia from Microsoft just integrated Yaralyzer into his existing site)

    - Github: github.com/michelcrypt4d4mus/y
    - Pypi: pypi.org/project/yaralyzer/
    - on macOS you can also get it with #Homebrew by installing Pdfalyzer: brew install pdfalyzer

    #ascii #asciiArt #blueteam #cybersecurity #detectionEngineering #DFIR #forensics #FOSS #GPL #hacking #infosec #KaliLinux #maldoc #malware #malwareAnalysis #malwareDetection #openSource #pypi #python #redteam #reverseEngineering #reversing #Threatassessment #threathunting #YARA #YARArule #YARArules

  8. Python Package Guru by Fabrizio Damicelli

    pypkg.guru

    search over #PyPI #python #packages
    faster than on pypi.org and interactively

    discover packages based on their capabilities (eg, try out "fast dataframe")

    #neurodon #neuroscience #compsci #scipy

  9. Released v1.17.0 of The Pdfalyzer, the surprisingly popular tool for analyzing (possibly malicious) PDFs I created after my own unpleasant experience. Now ships with two command line tools for extracting stuff from PDF files:

    1. extract_text_from_pdfs() - brute force extract all text from a PDF, including doing an #OCR extraction of any embedded images

    2. extract_pdf_pages() - rip a page range from a #PDF and write them to a new one

    * Github: github.com/michelcrypt4d4mus/p
    * Pypi: pypi.org/project/pdfalyzer/
    * Homebrew: formulae.brew.sh/formula/pdfal
    * Fun thread someone made last week using Pdfalyzer to explain some of how byzantine the PDF format is: x.com/VikParuchuri/status/1965

    #pypi #python #pdf #pdfs #malware #Threatassessment #maldoc #malwareanalysis #homebrew #infosec #cybersecurity #yararule #PdfFies

  10. Just published version 1.16.6 of The Pdfalyzer, the surprisingly popular tool for analyzing (possibly malicious) PDFs I created after my own unpleasant encounter with such a creature. Includes a (kind of janky) #YARA rule for #GIFTEDCROOK infostealer PDFs.

    * Github: github.com/michelcrypt4d4mus/p
    * Pypi: pypi.org/project/pdfalyzer/
    * Homebrew: formulae.brew.sh/formula/pdfal

    #pypi #python #pdf #pdfs #malware #Threatassessment #maldoc #malwareanalysis #homebrew #infosec #cybersecurity #yararule