#pypi — Public Fediverse posts

Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.

Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.

https://gitweb.gentoo.org/proj/mgorny-dev-scripts.git/tree/bin/get-latest-upstream-version

#Gentoo

Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.

Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.

https://gitweb.gentoo.org/proj/mgorny-dev-scripts.git/tree/bin/get-latest-upstream-version

#Gentoo

Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.

Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.

https://gitweb.gentoo.org/proj/mgorny-dev-scripts.git/tree/bin/get-latest-upstream-version

#Gentoo

Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.

Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.

https://gitweb.gentoo.org/proj/mgorny-dev-scripts.git/tree/bin/get-latest-upstream-version

#Gentoo

Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.

Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.

https://gitweb.gentoo.org/proj/mgorny-dev-scripts.git/tree/bin/get-latest-upstream-version

#Gentoo

Latest PyPi Compromise

A supply chain attack targeting the Microsoft DurableTask Python client compromised versions 1.4.1, 1.4.2, and 1.4.3 on PyPi. The threat actor gained access through a compromised GitHub account previously linked to attacks, using stolen credentials to dump GitHub secrets containing PyPi tokens. The evolved payload targets Linux systems, stealing credentials from AWS, Azure, GCP, Kubernetes, Vault, and password managers like Bitwarden and 1Password. It propagates via AWS SSM and Kubernetes lateral movement, limited to 5 targets per infected host. The payload scrapes shell history, bruteforces password managers, and establishes persistence through infection markers. Compromised packages were quarantined following analysis.

Pulse ID: 6a0ce3b0ad791179648c47b0
Pulse Link: https://otx.alienvault.com/pulse/6a0ce3b0ad791179648c47b0
Pulse Author: AlienVault
Created: 2026-05-19 22:26:56

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AWS #Azure #BruteForce #CyberSecurity #GitHub #InfoSec #Linux #Microsoft #OTX #OpenThreatExchange #Password #PyPI #Python #RCE #SupplyChain #Word #bot #AlienVault

https://blog.gslin.org/archives/2025/08/20/12585/pypi-%e6%9c%80%e8%bf%91%e7%99%bc%e8%a1%a8%e7%9a%84%e4%bf%9d%e8%ad%b7%e6%a9%9f%e5%88%b6-%e9%98%b2%e6%ad%a2-domain-resurrection-attack/

PyPI 最近發表的保護機制 (防止 Domain Resurrection Attack)

#account #attack #cctld #domain #email #gtld #mail #pypi #rdap #recovery #resurrection #security #tld #whois

One question about #PyPy #PyPi is how many functions like #xz will they NOT find at this point of minimal #Python library backdoors especially iF this is being used in the Enterprise #Fortune1000 and below as a vector IN, eh?

🐛🚪🚪🚪🚪🚪🚪🚪🚪🚪 🔍👀
☣️
👇
https://www.virustotal.com/graph/embed/ga60e68b3e1744e36b0e4b0cc98f17f1a19ec96449bb34313a0b3a4b3cf287cc3