Application Security
Dependabot gets a three-day cooldown window before opening pull requests, and PyPI rejects file uploads to releases older than 14 days.
Hi, what are you looking for?
SecurityWeek
All posts tagged "PyPI"
Malware & Threats
The most recent variants of the self-propagating attacks are named Miasma and Hades.
Malware & Threats
Two malicious versions of the popular SDK were uploaded to the PyPI registry, targeting Windows, macOS, and Linux.
Application Security
The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.
Phishing
Threat actors impersonating PyPI ask users to verify their email for security purposes, directing them to fake websites.
Malware & Threats
Python developers looking to integrate DeepSeek into their projects were targeted with malicious packages delivered through PyPI.
Malware & Threats
Multiple Python packages referencing dependencies containing cryptocurrency-stealing code were published to PyPI.
Malware & Threats
Maintainers of the Python Package Index (PyPI) repository were forced to suspend new project creation and new user registration to mitigate a malware upload...
Application Security
GitGuardian discovered roughly 4,000 secrets in nearly 3,000 PyPI packages, including Azure, AWS, and GitHub keys.
Identity & Access
PyPI will require all accounts that maintain a project to enable two-factor authentication (2FA) by the end of 2023.
Malware & Threats
Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets.
Data Protection
Data Breaches
CISO Conversations
Email Security
Artificial Intelligence
Artificial Intelligence
Noteworthy stories that might have slipped under the radar: BofA adds 1,000 patching contractors, KGB RAT pairs data theft with jump scares, and Langflow...
Vulnerabilities
Artificial Intelligence
Vulnerabilities
Vulnerabilities