#pypi — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #pypi, aggregated by home.social.
-
Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.
Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.
https://gitweb.gentoo.org/proj/mgorny-dev-scripts.git/tree/bin/get-latest-upstream-version
-
Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.
Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.
https://gitweb.gentoo.org/proj/mgorny-dev-scripts.git/tree/bin/get-latest-upstream-version
-
Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.
Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.
https://gitweb.gentoo.org/proj/mgorny-dev-scripts.git/tree/bin/get-latest-upstream-version
-
Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.
Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.
https://gitweb.gentoo.org/proj/mgorny-dev-scripts.git/tree/bin/get-latest-upstream-version
-
Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps.
Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely.
https://gitweb.gentoo.org/proj/mgorny-dev-scripts.git/tree/bin/get-latest-upstream-version
-
PyPI file hosting errors caused weeks of 502s. See how a Fastly CDN 502 error was traced to one cache node and fixed by August 28.
#PyPI #Fastly #CDN #Cybersecurity #DevOps #Python #InfraSecurity #CloudSecurity
https://securityonline.info/pypi-file-hosting-errors/?utm_source=mastodon&utm_medium=jetpack_social
-
This Week in Security: AI Generated Reports, More AI Generated Reports, GitHub Chaos, and More Linux Vulnerabilities
-
Latest PyPi Compromise
A supply chain attack targeting the Microsoft DurableTask Python client compromised versions 1.4.1, 1.4.2, and 1.4.3 on PyPi. The threat actor gained access through a compromised GitHub account previously linked to attacks, using stolen credentials to dump GitHub secrets containing PyPi tokens. The evolved payload targets Linux systems, stealing credentials from AWS, Azure, GCP, Kubernetes, Vault, and password managers like Bitwarden and 1Password. It propagates via AWS SSM and Kubernetes lateral movement, limited to 5 targets per infected host. The payload scrapes shell history, bruteforces password managers, and establishes persistence through infection markers. Compromised packages were quarantined following analysis.
Pulse ID: 6a0ce3b0ad791179648c47b0
Pulse Link: https://otx.alienvault.com/pulse/6a0ce3b0ad791179648c47b0
Pulse Author: AlienVault
Created: 2026-05-19 22:26:56Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#AWS #Azure #BruteForce #CyberSecurity #GitHub #InfoSec #Linux #Microsoft #OTX #OpenThreatExchange #Password #PyPI #Python #RCE #SupplyChain #Word #bot #AlienVault
-
Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & 169 Packages
A large-scale supply chain attack targeted npm and PyPI packages from major projects like TanStack, Mistral AI, UiPath, and OpenSearch, exploiting GitHub Actions vulnerabilities to steal credentials and publish malici...
🔗 https://salehgnutux.github.io/GT-NEWSTECH/en/ai/mini-shai-hulud-supply-chain-attack/
#Mini_Shai-Hulud #Cybersecurity #Supply_Chain #npm #PyPI #TanStack #Mistral_AI #GitHub_Actions
-
دودة Mini Shai-Hulud: هجوم سلسلة توريد يطال TanStack وMistral AI و169 حزمة برمجية
هجوم واسع النطاق لسلسلة التوريد استهدف حزم npm وPyPI الخاصة بمشاريع كبرى مثل TanStack وMistral AI وUiPath وOpenSearch، مستغلاً ثغرات في GitHub Actions لسرقة الشهادات ونشر برمجيات خبيثة مع أدوات إثبات صحة مزورة.
🔗 https://salehgnutux.github.io/GT-NEWSTECH/ar/ai/mini-shai-hulud-supply-chain-attack/
#Mini_Shai-Hulud #أمن_سيبراني #سلسلة_توريد #npm #PyPI #TanStack #Mistral_AI #GitHub_Actions
-
Mini Shai-Hulud: TeamPCP compromette 160+ pacchetti npm e PyPI in un supply chain attack che ha colpito TanStack, Mistral AI e OpenAI
Tra il 11 e il 14 maggio 2026, il gruppo TeamPCP ha compromesso oltre 160 pacchetti npm e 2 PyPI in un supply chain attack di nuova generazione soprannominato 'Mini Shai-Hulud'. Attraverso l'avvelenamento della cache GitHub Actions, il malware si è auto-propagato nei namespace di TanStack, Mistral AI e UiPath. Il pacchetto node-ipc (822K download settimanali) è stato compromesso separatamente con un payload che rubava 90+ categorie di credenziali. Tra le vittime: due dipendenti di OpenAI. -
Il colloquio di lavoro come arma: Lazarus Group e la campagna Graphalgo contro gli sviluppatori crypto
Da maggio 2025, Lazarus Group conduce la campagna Graphalgo: 192 pacchetti npm e PyPI malevoli distribuiti tramite finti colloqui di lavoro tecnici per sviluppatori blockchain. Il malware a tre stadi punta direttamente ai wallet MetaMask. Un'operazione di cyberspionaggio e furto crypto a firma nordcoreana tuttora attiva. -
#pypi on the #sha1hulud situation:
"PyPI has not been exploited, however some PyPI credentials were found exposed in compromised repositories. We've revoked these tokens as a precaution, there's no evidence they have been used maliciously. This post raises awareness about the attack and encourages proactive steps to secure your accounts, especially if you're using build platforms to publish packages to PyPI."
-
#pypi on the #sha1hulud situation:
"PyPI has not been exploited, however some PyPI credentials were found exposed in compromised repositories. We've revoked these tokens as a precaution, there's no evidence they have been used maliciously. This post raises awareness about the attack and encourages proactive steps to secure your accounts, especially if you're using build platforms to publish packages to PyPI."
-
#pypi on the #sha1hulud situation:
"PyPI has not been exploited, however some PyPI credentials were found exposed in compromised repositories. We've revoked these tokens as a precaution, there's no evidence they have been used maliciously. This post raises awareness about the attack and encourages proactive steps to secure your accounts, especially if you're using build platforms to publish packages to PyPI."
-
#pypi on the #sha1hulud situation:
"PyPI has not been exploited, however some PyPI credentials were found exposed in compromised repositories. We've revoked these tokens as a precaution, there's no evidence they have been used maliciously. This post raises awareness about the attack and encourages proactive steps to secure your accounts, especially if you're using build platforms to publish packages to PyPI."
-
#pypi on the #sha1hulud situation:
"PyPI has not been exploited, however some PyPI credentials were found exposed in compromised repositories. We've revoked these tokens as a precaution, there's no evidence they have been used maliciously. This post raises awareness about the attack and encourages proactive steps to secure your accounts, especially if you're using build platforms to publish packages to PyPI."