#pypi — Public Fediverse posts

Wednesday night I'll be speaking at the NYC Open Source Security User Group meetup.

If your release pipeline still has stored API tokens in it, come find out how to delete them for good.

Wed Aug 26, 6-8 PM, pizza at 6, talk at 6:30
Amazon office, 12 W 39th St, NYC

Free, but you must register for building access - last chance: https://luma.com/5mwalp6p?tk=JivtHQ

Already registered? See you soon! Bring a colleague, have them sign up first - building access requires photo ID.

#Python #OpenSourceSecurity #SupplyChainSecurity #NYCTech #PyPI

Wednesday night I'll be speaking at the NYC Open Source Security User Group meetup.

If your release pipeline still has stored API tokens in it, come find out how to delete them for good.

Wed Aug 26, 6-8 PM, pizza at 6, talk at 6:30
Amazon office, 12 W 39th St, NYC

Free, but you must register for building access - last chance: https://luma.com/5mwalp6p?tk=JivtHQ

Already registered? See you soon! Bring a colleague, have them sign up first - building access requires photo ID.

#Python #OpenSourceSecurity #SupplyChainSecurity #NYCTech #PyPI

Wednesday night I'll be speaking at the NYC Open Source Security User Group meetup.

If your release pipeline still has stored API tokens in it, come find out how to delete them for good.

Wed Aug 26, 6-8 PM, pizza at 6, talk at 6:30
Amazon office, 12 W 39th St, NYC

Free, but you must register for building access - last chance: https://luma.com/5mwalp6p?tk=JivtHQ

Already registered? See you soon! Bring a colleague, have them sign up first - building access requires photo ID.

#Python #OpenSourceSecurity #SupplyChainSecurity #NYCTech #PyPI

Wednesday night I'll be speaking at the NYC Open Source Security User Group meetup.

If your release pipeline still has stored API tokens in it, come find out how to delete them for good.

Wed Aug 26, 6-8 PM, pizza at 6, talk at 6:30
Amazon office, 12 W 39th St, NYC

Free, but you must register for building access - last chance: https://luma.com/5mwalp6p?tk=JivtHQ

Already registered? See you soon! Bring a colleague, have them sign up first - building access requires photo ID.

#Python #OpenSourceSecurity #SupplyChainSecurity #NYCTech #PyPI

Wednesday night I'll be speaking at the NYC Open Source Security User Group meetup.

If your release pipeline still has stored API tokens in it, come find out how to delete them for good.

Wed Aug 26, 6-8 PM, pizza at 6, talk at 6:30
Amazon office, 12 W 39th St, NYC

Free, but you must register for building access - last chance: https://luma.com/5mwalp6p?tk=JivtHQ

Already registered? See you soon! Bring a colleague, have them sign up first - building access requires photo ID.

#Python #OpenSourceSecurity #SupplyChainSecurity #NYCTech #PyPI

@nedbat

Oh holy crap, I have to stop using #PyPI / #pip / #pipx now, too? 🤦‍♂️

@nedbat

Oh holy crap, I have to stop using #PyPI / #pip / #pipx now, too? 🤦‍♂️

@nedbat

Oh holy crap, I have to stop using #PyPI / #pip / #pipx now, too? 🤦‍♂️

@nedbat

Oh holy crap, I have to stop using #PyPI / #pip / #pipx now, too? 🤦‍♂️

@nedbat

Oh holy crap, I have to stop using #PyPI / #pip / #pipx now, too? 🤦‍♂️

LiteLLM Supply-Chain Attack Hits 2,500+ Orgs

TeamPCP compromised the popular AI gateway library, exposing GitHub tokens, cloud keys and API secrets across Microsoft, NVIDIA, IBM and hundreds more

https://pulseofnations.lol/litellm-supply-chain-2/

#AiSecurity #CredentialTheft #Cybersecurity #Litellm #Pypi #Sandclock #SupplyChainAttack #Teampcp

#PyPI runs on ~zero AWS cost thanks to @fastlydevs caching 99% of traffic + AWS credits covering the rest. Huge thanks to both! But 2026 broke an 8-year streak: AWS spend is up 69% YoY as agents & CI runs surge.

@Monorepo, PSF Director of Engineering, on what's changing: https://pyfound.blogspot.com/2026/08/how-aws-powers-pypi-and-psf.html

#Python

#PyPI runs on ~zero AWS cost thanks to @fastlydevs caching 99% of traffic + AWS credits covering the rest. Huge thanks to both! But 2026 broke an 8-year streak: AWS spend is up 69% YoY as agents & CI runs surge.

@Monorepo, PSF Director of Engineering, on what's changing: https://pyfound.blogspot.com/2026/08/how-aws-powers-pypi-and-psf.html

#Python

#PyPI runs on ~zero AWS cost thanks to @fastlydevs caching 99% of traffic + AWS credits covering the rest. Huge thanks to both! But 2026 broke an 8-year streak: AWS spend is up 69% YoY as agents & CI runs surge.

@Monorepo, PSF Director of Engineering, on what's changing: https://pyfound.blogspot.com/2026/08/how-aws-powers-pypi-and-psf.html

#Python

#PyPI runs on ~zero AWS cost thanks to @fastlydevs caching 99% of traffic + AWS credits covering the rest. Huge thanks to both! But 2026 broke an 8-year streak: AWS spend is up 69% YoY as agents & CI runs surge.

@Monorepo, PSF Director of Engineering, on what's changing: https://pyfound.blogspot.com/2026/08/how-aws-powers-pypi-and-psf.html

#Python

#PyPI runs on ~zero AWS cost thanks to @fastlydevs caching 99% of traffic + AWS credits covering the rest. Huge thanks to both! But 2026 broke an 8-year streak: AWS spend is up 69% YoY as agents & CI runs surge.

@Monorepo, PSF Director of Engineering, on what's changing: https://pyfound.blogspot.com/2026/08/how-aws-powers-pypi-and-psf.html

#Python

Зачем PyPI закреплять префиксы пакетов за организациями

Имя пакета в реестре часто оказывается первым сигналом того, что компоненту можно доверять. Разработчик видит название вроде google-cloud-storage , opentelemetry-sdk или apache-airflow-providers-slack раньше, чем открывает исходный код, и ожидает, что знакомый префикс указывает на известный проект. В PyPI это ожидание пока ничем не подтверждено: реестр формально не связывает общее начало имени с его владельцем, поэтому любой свободный вариант может зарегистрировать посторонний пользователь. В конце июня 2026 года в Python-сообществе приняли PEP 752 (мы писали об этом здесь ). Он предлагает закреплять за организацией не отдельные имена, а префикс и все будущие проекты, которые ему соответствуют. Если PyPI реализует этот механизм, то пакет с именем вроде “google-cloud-new-service” сможет опубликовать только та организация, которой принадлежит право на этот префикс или которой разрешили пользоваться этим правом. На первый взгляд, решение очевидное. Однако общий префикс не всегда означает, что все пакеты принадлежат одному издателю. Иногда он обозначает семейство официальных библиотек, а иногда экосистему сторонних дополнений. Меня зовут Артем Максимов, я отвечаю за аналитику продуктов в CodeScoring. Вместе с дата-инженером Артемом Ивановым в этой статье мы разбираемся, какую проблему решает PEP 752, где проходит его граница и что нам показывает база данных CodeScoring.

https://habr.com/ru/companies/codescoring/articles/1072070/

#pypi #python #pep_752 #пакетные_репозитории #безопасность_зависимостей #неймсквоттинг #пространства_имен #цепочка_поставки_по #пакеты_python #open_source

Зачем PyPI закреплять префиксы пакетов за организациями

Имя пакета в реестре часто оказывается первым сигналом того, что компоненту можно доверять. Разработчик видит название вроде google-cloud-storage , opentelemetry-sdk или apache-airflow-providers-slack раньше, чем открывает исходный код, и ожидает, что знакомый префикс указывает на известный проект. В PyPI это ожидание пока ничем не подтверждено: реестр формально не связывает общее начало имени с его владельцем, поэтому любой свободный вариант может зарегистрировать посторонний пользователь. В конце июня 2026 года в Python-сообществе приняли PEP 752 (мы писали об этом здесь ). Он предлагает закреплять за организацией не отдельные имена, а префикс и все будущие проекты, которые ему соответствуют. Если PyPI реализует этот механизм, то пакет с именем вроде “google-cloud-new-service” сможет опубликовать только та организация, которой принадлежит право на этот префикс или которой разрешили пользоваться этим правом. На первый взгляд, решение очевидное. Однако общий префикс не всегда означает, что все пакеты принадлежат одному издателю. Иногда он обозначает семейство официальных библиотек, а иногда экосистему сторонних дополнений. Меня зовут Артем Максимов, я отвечаю за аналитику продуктов в CodeScoring. Вместе с дата-инженером Артемом Ивановым в этой статье мы разбираемся, какую проблему решает PEP 752, где проходит его граница и что нам показывает база данных CodeScoring.

https://habr.com/ru/companies/codescoring/articles/1072070/

#pypi #python #pep_752 #пакетные_репозитории #безопасность_зависимостей #неймсквоттинг #пространства_имен #цепочка_поставки_по #пакеты_python #open_source

Зачем PyPI закреплять префиксы пакетов за организациями

Имя пакета в реестре часто оказывается первым сигналом того, что компоненту можно доверять. Разработчик видит название вроде google-cloud-storage , opentelemetry-sdk или apache-airflow-providers-slack раньше, чем открывает исходный код, и ожидает, что знакомый префикс указывает на известный проект. В PyPI это ожидание пока ничем не подтверждено: реестр формально не связывает общее начало имени с его владельцем, поэтому любой свободный вариант может зарегистрировать посторонний пользователь. В конце июня 2026 года в Python-сообществе приняли PEP 752 (мы писали об этом здесь ). Он предлагает закреплять за организацией не отдельные имена, а префикс и все будущие проекты, которые ему соответствуют. Если PyPI реализует этот механизм, то пакет с именем вроде “google-cloud-new-service” сможет опубликовать только та организация, которой принадлежит право на этот префикс или которой разрешили пользоваться этим правом. На первый взгляд, решение очевидное. Однако общий префикс не всегда означает, что все пакеты принадлежат одному издателю. Иногда он обозначает семейство официальных библиотек, а иногда экосистему сторонних дополнений. Меня зовут Артем Максимов, я отвечаю за аналитику продуктов в CodeScoring. Вместе с дата-инженером Артемом Ивановым в этой статье мы разбираемся, какую проблему решает PEP 752, где проходит его граница и что нам показывает база данных CodeScoring.

https://habr.com/ru/companies/codescoring/articles/1072070/

#pypi #python #pep_752 #пакетные_репозитории #безопасность_зависимостей #неймсквоттинг #пространства_имен #цепочка_поставки_по #пакеты_python #open_source

Oof: https://pepy.tech/search?q=snakemake-executor-plugin-slurm

That would be > 500 k via #PyPI and > 100 k via #Conda (got the number with `condastats`)

That, of course, includes all downloads over all versions and including CI usage.

However, there are ~5,000 downloads per relevant version update for Conda alone. This fills me with pride and gives some ammunition for the "for admins" part of my #Snakemake #HPC tutorial. 😉

#SLURM

Oof: https://pepy.tech/search?q=snakemake-executor-plugin-slurm

That would be > 500 k via #PyPI and > 100 k via #Conda (got the number with `condastats`)

That, of course, includes all downloads over all versions and including CI usage.

However, there are ~5,000 downloads per relevant version update for Conda alone. This fills me with pride and gives some ammunition for the "for admins" part of my #Snakemake #HPC tutorial. 😉

#SLURM

Oof: https://pepy.tech/search?q=snakemake-executor-plugin-slurm

That would be > 500 k via #PyPI and > 100 k via #Conda (got the number with `condastats`)

That, of course, includes all downloads over all versions and including CI usage.

However, there are ~5,000 downloads per relevant version update for Conda alone. This fills me with pride and gives some ammunition for the "for admins" part of my #Snakemake #HPC tutorial. 😉

#SLURM

Oof: https://pepy.tech/search?q=snakemake-executor-plugin-slurm

That would be > 500 k via #PyPI and > 100 k via #Conda (got the number with `condastats`)

That, of course, includes all downloads over all versions and including CI usage.

However, there are ~5,000 downloads per relevant version update for Conda alone. This fills me with pride and gives some ammunition for the "for admins" part of my #Snakemake #HPC tutorial. 😉

#SLURM

Oof: https://pepy.tech/search?q=snakemake-executor-plugin-slurm

That would be > 500 k via #PyPI and > 100 k via #Conda (got the number with `condastats`)

That, of course, includes all downloads over all versions and including CI usage.

However, there are ~5,000 downloads per relevant version update for Conda alone. This fills me with pride and gives some ammunition for the "for admins" part of my #Snakemake #HPC tutorial. 😉

#SLURM

For the sake of an argument, I wanted to retrieve the cumulative download stats of a package on both Conda and PyPI. Both sites do not display this figure (any more?). For Conda, you now have to download `condastats`. At least, it is easy to use.

For PyPI, there are apparently tools. All of which require getting a token from Google. Seriously?

Does anyone know a straight forward approach to retrieve PyPI download stats over the lifetime of a package?

#Conda #pypi

For the sake of an argument, I wanted to retrieve the cumulative download stats of a package on both Conda and PyPI. Both sites do not display this figure (any more?). For Conda, you now have to download `condastats`. At least, it is easy to use.

For PyPI, there are apparently tools. All of which require getting a token from Google. Seriously?

Does anyone know a straight forward approach to retrieve PyPI download stats over the lifetime of a package?

#Conda #pypi

For the sake of an argument, I wanted to retrieve the cumulative download stats of a package on both Conda and PyPI. Both sites do not display this figure (any more?). For Conda, you now have to download `condastats`. At least, it is easy to use.

For PyPI, there are apparently tools. All of which require getting a token from Google. Seriously?

Does anyone know a straight forward approach to retrieve PyPI download stats over the lifetime of a package?

#Conda #pypi

For the sake of an argument, I wanted to retrieve the cumulative download stats of a package on both Conda and PyPI. Both sites do not display this figure (any more?). For Conda, you now have to download `condastats`. At least, it is easy to use.

For PyPI, there are apparently tools. All of which require getting a token from Google. Seriously?

Does anyone know a straight forward approach to retrieve PyPI download stats over the lifetime of a package?

#Conda #pypi

For the sake of an argument, I wanted to retrieve the cumulative download stats of a package on both Conda and PyPI. Both sites do not display this figure (any more?). For Conda, you now have to download `condastats`. At least, it is easy to use.

For PyPI, there are apparently tools. All of which require getting a token from Google. Seriously?

Does anyone know a straight forward approach to retrieve PyPI download stats over the lifetime of a package?

#Conda #pypi

I need to think about how I'm voting the Packaging Council election. So many great nominees, but a lot that I don't recognize because they're dealing with a different part of the ecosystem and not the core where I know the most people. I feel like I want the inaugural council to be core people who were already setting a good direction, but "who I know" also feels like the wrong way to vote. And there's still too many people who I know! 😅 https://www.python.org/nominations/elections/2026-python-packaging-council/nominees/ #Python #PyPI

I need to think about how I'm voting the Packaging Council election. So many great nominees, but a lot that I don't recognize because they're dealing with a different part of the ecosystem and not the core where I know the most people. I feel like I want the inaugural council to be core people who were already setting a good direction, but "who I know" also feels like the wrong way to vote. And there's still too many people who I know! 😅 https://www.python.org/nominations/elections/2026-python-packaging-council/nominees/ #Python #PyPI

I need to think about how I'm voting the Packaging Council election. So many great nominees, but a lot that I don't recognize because they're dealing with a different part of the ecosystem and not the core where I know the most people. I feel like I want the inaugural council to be core people who were already setting a good direction, but "who I know" also feels like the wrong way to vote. And there's still too many people who I know! 😅 https://www.python.org/nominations/elections/2026-python-packaging-council/nominees/ #Python #PyPI

I need to think about how I'm voting the Packaging Council election. So many great nominees, but a lot that I don't recognize because they're dealing with a different part of the ecosystem and not the core where I know the most people. I feel like I want the inaugural council to be core people who were already setting a good direction, but "who I know" also feels like the wrong way to vote. And there's still too many people who I know! 😅 https://www.python.org/nominations/elections/2026-python-packaging-council/nominees/ #Python #PyPI

I need to think about how I'm voting the Packaging Council election. So many great nominees, but a lot that I don't recognize because they're dealing with a different part of the ecosystem and not the core where I know the most people. I feel like I want the inaugural council to be core people who were already setting a good direction, but "who I know" also feels like the wrong way to vote. And there's still too many people who I know! 😅 https://www.python.org/nominations/elections/2026-python-packaging-council/nominees/ #Python #PyPI

LiteLLM, an open-source toolkit for AI-assisted development, was compromised via PyPI during a 40-minute window in March. The malicious versions exfiltrated credentials and secrets from 434,000 CI/CD pipelines. Hudson Rock analyzed 195 TB of data; the origin of the dataset has not been attributed yet.

#SupplyChainAttack #PyPI #CI_CD #DevSecOps

https://cyberworldops.eu/en/litellm-supply-chain-breach-exposes-secrets-from-434000-cicd-pipelines

LiteLLM, an open-source toolkit for AI-assisted development, was compromised via PyPI during a 40-minute window in March. The malicious versions exfiltrated credentials and secrets from 434,000 CI/CD pipelines. Hudson Rock analyzed 195 TB of data; the origin of the dataset has not been attributed yet.

#SupplyChainAttack #PyPI #CI_CD #DevSecOps

https://cyberworldops.eu/en/litellm-supply-chain-breach-exposes-secrets-from-434000-cicd-pipelines

I've published my todo-linter to PyPI, so you can install it without needing to use pre-commit: https://pypi.org/project/todo-linter/

Tomorrow I'll make a Sublime Linter plugin so you can use it from within Sublime Text.

H/T to @ehmatthes looking at my pytest issue earlier. 🍻

#python #pypi #linter #CodeQuality

I've published my todo-linter to PyPI, so you can install it without needing to use pre-commit: https://pypi.org/project/todo-linter/

Tomorrow I'll make a Sublime Linter plugin so you can use it from within Sublime Text.

H/T to @ehmatthes looking at my pytest issue earlier. 🍻

#python #pypi #linter #CodeQuality

I've published my todo-linter to PyPI, so you can install it without needing to use pre-commit: https://pypi.org/project/todo-linter/

Tomorrow I'll make a Sublime Linter plugin so you can use it from within Sublime Text.

H/T to @ehmatthes looking at my pytest issue earlier. 🍻

#python #pypi #linter #CodeQuality

I've published my todo-linter to PyPI, so you can install it without needing to use pre-commit: https://pypi.org/project/todo-linter/

Tomorrow I'll make a Sublime Linter plugin so you can use it from within Sublime Text.

H/T to @ehmatthes looking at my pytest issue earlier. 🍻

#python #pypi #linter #CodeQuality

I've published my todo-linter to PyPI, so you can install it without needing to use pre-commit: https://pypi.org/project/todo-linter/

Tomorrow I'll make a Sublime Linter plugin so you can use it from within Sublime Text.

H/T to @ehmatthes looking at my pytest issue earlier. 🍻

#python #pypi #linter #CodeQuality

@diazona @stylus Here's the recent big one https://blog.pypi.org/posts/2026-07-22-ui-updates/
#Python #PyPI

@diazona @stylus Here's the recent big one https://blog.pypi.org/posts/2026-07-22-ui-updates/
#Python #PyPI

@diazona @stylus Here's the recent big one https://blog.pypi.org/posts/2026-07-22-ui-updates/
#Python #PyPI

@diazona @stylus Here's the recent big one https://blog.pypi.org/posts/2026-07-22-ui-updates/
#Python #PyPI

@diazona @stylus Here's the recent big one https://blog.pypi.org/posts/2026-07-22-ui-updates/
#Python #PyPI

I mentioned last week, while releasing other #Python packages with artistic names (cf. warhol), that I had a long-neglected web-gallery tool called emin...

Neglected no longer! Now on #pypi emin 0.7.0 (which, tbh, should probably be a 1.x by now): https://pypi.org/project/emin/

- super-simple command-line for building web image galleries
- bitmap and PDF + EPS formats all supported with thumbnails
- integrated standalone or CDN Lightbox3 display
- optional zip archive
- Cheetah3 page templating

I mentioned last week, while releasing other #Python packages with artistic names (cf. warhol), that I had a long-neglected web-gallery tool called emin...

Neglected no longer! Now on #pypi emin 0.7.0 (which, tbh, should probably be a 1.x by now): https://pypi.org/project/emin/

- super-simple command-line for building web image galleries
- bitmap and PDF + EPS formats all supported with thumbnails
- integrated standalone or CDN Lightbox3 display
- optional zip archive
- Cheetah3 page templating

I mentioned last week, while releasing other #Python packages with artistic names (cf. warhol), that I had a long-neglected web-gallery tool called emin...

Neglected no longer! Now on #pypi emin 0.7.0 (which, tbh, should probably be a 1.x by now): https://pypi.org/project/emin/

- super-simple command-line for building web image galleries
- bitmap and PDF + EPS formats all supported with thumbnails
- integrated standalone or CDN Lightbox3 display
- optional zip archive
- Cheetah3 page templating

I mentioned last week, while releasing other #Python packages with artistic names (cf. warhol), that I had a long-neglected web-gallery tool called emin...

Neglected no longer! Now on #pypi emin 0.7.0 (which, tbh, should probably be a 1.x by now): https://pypi.org/project/emin/

- super-simple command-line for building web image galleries
- bitmap and PDF + EPS formats all supported with thumbnails
- integrated standalone or CDN Lightbox3 display
- optional zip archive
- Cheetah3 page templating

#PyPI has moved the data column to the other side of the page and I'm not prepared for such a huge change in my world! O_o

#PyPI has moved the data column to the other side of the page and I'm not prepared for such a huge change in my world! O_o

#PyPI has moved the data column to the other side of the page and I'm not prepared for such a huge change in my world! O_o

#PyPI has moved the data column to the other side of the page and I'm not prepared for such a huge change in my world! O_o

#PyPI has moved the data column to the other side of the page and I'm not prepared for such a huge change in my world! O_o

New #GitHub , #PyPI Policies Hope to Boost #SupplyChain #Security https://developers.slashdot.org/story/26/08/01/0511237/new-github-pypi-policies-hope-to-boost-supply-chain-security?utm_source=rss1.0mainlinkanon&utm_medium=feed

New #GitHub , #PyPI Policies Hope to Boost #SupplyChain #Security https://developers.slashdot.org/story/26/08/01/0511237/new-github-pypi-policies-hope-to-boost-supply-chain-security?utm_source=rss1.0mainlinkanon&utm_medium=feed

New #GitHub , #PyPI Policies Hope to Boost #SupplyChain #Security https://developers.slashdot.org/story/26/08/01/0511237/new-github-pypi-policies-hope-to-boost-supply-chain-security?utm_source=rss1.0mainlinkanon&utm_medium=feed

New #GitHub , #PyPI Policies Hope to Boost #SupplyChain #Security https://developers.slashdot.org/story/26/08/01/0511237/new-github-pypi-policies-hope-to-boost-supply-chain-security?utm_source=rss1.0mainlinkanon&utm_medium=feed

New #GitHub , #PyPI Policies Hope to Boost #SupplyChain #Security https://developers.slashdot.org/story/26/08/01/0511237/new-github-pypi-policies-hope-to-boost-supply-chain-security?utm_source=rss1.0mainlinkanon&utm_medium=feed