Sigmoid Social

yossarian (1.3.6.1.4.1.55738)this is pretty crazy to me: nearly 1 out of every 15 files *ever* uploaded to PyPI was published with Trusted Publishing, which we only enabled just over 2 years ago!that points to both incredible growth in Python's packaging numbers and really remarkable adoption of Trusted Publishing, probably in a large part because of how we were able to make it the default in GitHub Actions.(currently 984K files published with TP, out of approximately 15M uploaded over all time.)<a href="https://infosec.exchange/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#python</a> <a href="https://infosec.exchange/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#pypi</a>

The New Oil<a href="https://mastodon.thenewoil.org/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a> now blocks domain resurrection attacks used for hijacking accounts<a href="https://www.bleepingcomputer.com/news/security/pypi-now-blocks-domain-resurrection-attacks-used-for-hijacking-accounts/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/pypi-now-blocks-domain-resurrection-attacks-used-for-hijacking-accounts/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a>

Gea-Suan Lin<a href="https://blog.gslin.org/archives/2025/08/20/12585/pypi-%e6%9c%80%e8%bf%91%e7%99%bc%e8%a1%a8%e7%9a%84%e4%bf%9d%e8%ad%b7%e6%a9%9f%e5%88%b6-%e9%98%b2%e6%ad%a2-domain-resurrection-attack/" rel="nofollow noopener" translate="no" target="_blank">https://blog.gslin.org/archives/2025/08/20/12585/pypi-%e6%9c%80%e8%bf%91%e7%99%bc%e8%a1%a8%e7%9a%84%e4%bf%9d%e8%ad%b7%e6%a9%9f%e5%88%b6-%e9%98%b2%e6%ad%a2-domain-resurrection-attack/</a>PyPI 最近發表的保護機制 (防止 Domain Resurrection Attack)<a href="https://abpe.org/tags/account" class="mention hashtag" rel="nofollow noopener" target="_blank">#account</a> <a href="https://abpe.org/tags/attack" class="mention hashtag" rel="nofollow noopener" target="_blank">#attack</a> <a href="https://abpe.org/tags/cctld" class="mention hashtag" rel="nofollow noopener" target="_blank">#cctld</a> <a href="https://abpe.org/tags/domain" class="mention hashtag" rel="nofollow noopener" target="_blank">#domain</a> <a href="https://abpe.org/tags/email" class="mention hashtag" rel="nofollow noopener" target="_blank">#email</a> <a href="https://abpe.org/tags/gtld" class="mention hashtag" rel="nofollow noopener" target="_blank">#gtld</a> <a href="https://abpe.org/tags/mail" class="mention hashtag" rel="nofollow noopener" target="_blank">#mail</a> <a href="https://abpe.org/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#pypi</a> <a href="https://abpe.org/tags/rdap" class="mention hashtag" rel="nofollow noopener" target="_blank">#rdap</a> <a href="https://abpe.org/tags/recovery" class="mention hashtag" rel="nofollow noopener" target="_blank">#recovery</a> <a href="https://abpe.org/tags/resurrection" class="mention hashtag" rel="nofollow noopener" target="_blank">#resurrection</a> <a href="https://abpe.org/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://abpe.org/tags/tld" class="mention hashtag" rel="nofollow noopener" target="_blank">#tld</a> <a href="https://abpe.org/tags/whois" class="mention hashtag" rel="nofollow noopener" target="_blank">#whois</a>

Hacker NewsPyPI Preventing Domain Resurrection Attacks<a href="https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections/" rel="nofollow noopener" translate="no" target="_blank">https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections/</a><a href="https://mastodon.social/tags/HackerNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#HackerNews</a> <a href="https://mastodon.social/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a> <a href="https://mastodon.social/tags/DomainSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#DomainSecurity</a> <a href="https://mastodon.social/tags/DomainResurrection" class="mention hashtag" rel="nofollow noopener" target="_blank">#DomainResurrection</a> <a href="https://mastodon.social/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://mastodon.social/tags/PythonCommunity" class="mention hashtag" rel="nofollow noopener" target="_blank">#PythonCommunity</a> <a href="https://mastodon.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenSource</a>

Python Package IndexPyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take over <a href="https://fosstodon.org/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a> accounts through password resets. <a href="https://fosstodon.org/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://fosstodon.org/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenSource</a> <a href="https://fosstodon.org/tags/SupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#SupplyChain</a> <a href="https://fosstodon.org/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections/" rel="nofollow noopener" translate="no" target="_blank">https://blog.pypi.org/posts/2025-08-18-preventing-domain-resurrections/</a>

Sam Stepanyan :verified: 🐘New supply-chain attacks hit open-source repos: <a href="https://infosec.exchange/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a>: termncolor & colorinal delivered multi-stage malware with Windows & Linux backdoors.<a href="https://infosec.exchange/tags/npm" class="mention hashtag" rel="nofollow noopener" target="_blank">#npm</a>: packages redux-ace,rtk-logger posed as dev tools & job tests, stealing iCloud Keychain, browser data, wallets: <a href="https://thehackernews.com/2025/08/malicious-pypi-and-npm-packages.html" rel="nofollow noopener" translate="no" target="_blank">https://thehackernews.com/2025/08/malicious-pypi-and-npm-packages.html</a>

SnackTracesI have done it, posted my first app to test PyPI.<a href="https://test.pypi.org/project/stdiceroller/" rel="nofollow noopener" translate="no" target="_blank">https://test.pypi.org/project/stdiceroller/</a>Try if you are interested. And any feedback, especially on the test PyPI package entry, is welcome and appreciated!<a href="https://hachyderm.io/@snacktraces/115045389951794135" rel="nofollow noopener" translate="no" target="_blank">https://hachyderm.io/@snacktraces/115045389951794135</a><a href="https://hachyderm.io/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#python</a> <a href="https://hachyderm.io/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#pypi</a>

yossarian (1.3.6.1.4.1.55738)super excited to have this land: you can now pull project status markers (PEP 792) from PyPI's APIs!<a href="https://blog.pypi.org/posts/2025-08-14-project-status-markers/" rel="nofollow noopener" translate="no" target="_blank">https://blog.pypi.org/posts/2025-08-14-project-status-markers/</a><a href="https://infosec.exchange/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#python</a> <a href="https://infosec.exchange/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#pypi</a>

Thomas Fricke (he/his)How its going in <a href="https://23.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a>UNMASKING PHANTOM DEPENDENCIES WITH SOFTWARE BILL-OF-MATERIALS AS ECOSYSTEM-NEUTRAL METADATA<a href="https://alpha-omega.dev/wp-content/uploads/sites/22/2025/08/Python-White-Paper-for-AO-3.pdf" rel="nofollow noopener" translate="no" target="_blank">https://alpha-omega.dev/wp-content/uploads/sites/22/2025/08/Python-White-Paper-for-AO-3.pdf</a>First noticed that there are dependency issues in the interview with the <a href="https://23.social/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#pypi</a> maintainer for the first time in 2021<a href="https://thomasfricke.de/pages/fossec/" rel="nofollow noopener" translate="no" target="_blank">https://thomasfricke.de/pages/fossec/</a>Copied the numbers from <a href="https://social.lfx.dev/@openssf" class="u-url mention" rel="nofollow noopener" target="_blank">@openssf</a> to kick off the <a href="https://mastodon.social/@sovtechfund" class="u-url mention" rel="nofollow noopener" target="_blank">@sovtechfund</a> This evolved nicely in the last years

Some Bits: Nelson's Linkblogpyx for Python: Company is starting a commercial package repository as an alternative to PyPI <a href="https://simonwillison.net/2025/Aug/13/pyx/" rel="nofollow noopener" translate="no" target="_blank">https://simonwillison.net/2025/Aug/13/pyx/</a> <a href="https://tech.lgbt/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#python</a> <a href="https://tech.lgbt/tags/astral" class="mention hashtag" rel="nofollow noopener" target="_blank">#astral</a> <a href="https://tech.lgbt/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#pypi</a> <a href="https://tech.lgbt/tags/pyx" class="mention hashtag" rel="nofollow noopener" target="_blank">#pyx</a> <a href="https://tech.lgbt/tags/vc" class="mention hashtag" rel="nofollow noopener" target="_blank">#vc</a> <a href="https://tech.lgbt/tags/uv" class="mention hashtag" rel="nofollow noopener" target="_blank">#uv</a> #+

R.L. Dane :Debian: :OpenBSD: 🍵 :MiraLovesYou:<a href="https://fosstodon.org/@graves501" class="u-url mention" rel="nofollow noopener" target="_blank">@graves501</a>pipx makes stuff like that mostly painless, in my experience. As long as what you're looking for is registered on <a href="https://polymaths.social/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a>.

Mike Fiedler, Code GardenerIncident Report of the recent <a href="https://hachyderm.io/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a> Phishing CampaignTL,DR: • PyPI was not breached • PyPI users were targeted with phishing emails • A single project saw uploads with malicious code and those releases have been removed<a href="https://blog.pypi.org/posts/2025-07-31-incident-report-phishing-attack/" rel="nofollow noopener" translate="no" target="_blank">https://blog.pypi.org/posts/2025-07-31-incident-report-phishing-attack/</a><a href="https://hachyderm.io/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://hachyderm.io/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenSource</a> <a href="https://hachyderm.io/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a>

The New OilHackers target <a href="https://mastodon.thenewoil.org/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> devs in <a href="https://mastodon.thenewoil.org/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#phishing</a> attacks using fake <a href="https://mastodon.thenewoil.org/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a> site<a href="https://www.bleepingcomputer.com/news/security/hackers-target-python-devs-in-phishing-attacks-using-fake-pypi-site/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/hackers-target-python-devs-in-phishing-attacks-using-fake-pypi-site/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a>

Andrii Kuznietsov🥷 Python Software Foundation попередила розробників, що хакери намагаються викрасти їхні облікові дані за допомогою фішингових атак, використовуючи підроблений веб-сайт Python Package Index (<a href="https://social.kyiv.dcomm.net.ua/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a>). <a href="https://www.bleepingcomputer.com/news/security/hackers-target-python-devs-in-phishing-attacks-using-fake-pypi-site/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/hackers-target-python-devs-in-phishing-attacks-using-fake-pypi-site/</a>

⚯ Michel de Cryptadamus ⚯Just released version 1.16.8 of The Pdfalyzer with a bunch of new and updated <a href="https://universeodon.com/tags/YARA" class="mention hashtag" rel="nofollow noopener" target="_blank">#YARA</a> rules to scan <a href="https://universeodon.com/tags/PDF" class="mention hashtag" rel="nofollow noopener" target="_blank">#PDF</a> files for malicious content. Links in the quoted toot below.<a href="https://universeodon.com/@cryptadamist/114768170683991686" rel="nofollow noopener" translate="no" target="_blank">https://universeodon.com/@cryptadamist/114768170683991686</a><a href="https://universeodon.com/tags/ascii" class="mention hashtag" rel="nofollow noopener" target="_blank">#ascii</a> <a href="https://universeodon.com/tags/asciiArt" class="mention hashtag" rel="nofollow noopener" target="_blank">#asciiArt</a> <a href="https://universeodon.com/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#blueteam</a> <a href="https://universeodon.com/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://universeodon.com/tags/detectionEngineering" class="mention hashtag" rel="nofollow noopener" target="_blank">#detectionEngineering</a> <a href="https://universeodon.com/tags/DFIR" class="mention hashtag" rel="nofollow noopener" target="_blank">#DFIR</a> <a href="https://universeodon.com/tags/forensics" class="mention hashtag" rel="nofollow noopener" target="_blank">#forensics</a> <a href="https://universeodon.com/tags/FOSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#FOSS</a> <a href="https://universeodon.com/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#hacking</a> <a href="https://universeodon.com/tags/homebrew" class="mention hashtag" rel="nofollow noopener" target="_blank">#homebrew</a> <a href="https://universeodon.com/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://universeodon.com/tags/KaliLinux" class="mention hashtag" rel="nofollow noopener" target="_blank">#KaliLinux</a> <a href="https://universeodon.com/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://universeodon.com/tags/malwareDetection" class="mention hashtag" rel="nofollow noopener" target="_blank">#malwareDetection</a> <a href="https://universeodon.com/tags/malwareAnalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#malwareAnalysis</a> <a href="https://universeodon.com/tags/openSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#openSource</a> <a href="https://universeodon.com/tags/pdf" class="mention hashtag" rel="nofollow noopener" target="_blank">#pdf</a> <a href="https://universeodon.com/tags/pdfs" class="mention hashtag" rel="nofollow noopener" target="_blank">#pdfs</a> <a href="https://universeodon.com/tags/pdfalyzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#pdfalyzer</a> <a href="https://universeodon.com/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#pypi</a> <a href="https://universeodon.com/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#python</a> <a href="https://universeodon.com/tags/redteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#redteam</a> <a href="https://universeodon.com/tags/reverseEngineering" class="mention hashtag" rel="nofollow noopener" target="_blank">#reverseEngineering</a> <a href="https://universeodon.com/tags/reversing" class="mention hashtag" rel="nofollow noopener" target="_blank">#reversing</a> <a href="https://universeodon.com/tags/Threatassessment" class="mention hashtag" rel="nofollow noopener" target="_blank">#Threatassessment</a> <a href="https://universeodon.com/tags/threathunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#threathunting</a> <a href="https://universeodon.com/tags/yaralyze" class="mention hashtag" rel="nofollow noopener" target="_blank">#yaralyze</a> <a href="https://universeodon.com/tags/yaralyzer" class="mention hashtag" rel="nofollow noopener" target="_blank">#yaralyzer</a> <a href="https://universeodon.com/tags/YARA" class="mention hashtag" rel="nofollow noopener" target="_blank">#YARA</a> <a href="https://universeodon.com/tags/YARArule" class="mention hashtag" rel="nofollow noopener" target="_blank">#YARArule</a> <a href="https://universeodon.com/tags/YARArules" class="mention hashtag" rel="nofollow noopener" target="_blank">#YARArules</a>

Python Rennes<a href="https://social.breizhcamp.org/tags/cybers%C3%A9curit%C3%A9" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersécurité</a> <a href="https://social.breizhcamp.org/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://fosstodon.org/@pypi" class="u-url mention" rel="nofollow noopener" target="_blank">@pypi</a> Une attaque de phishing est en cours pour voler les identifiants de connexion des personnes ayant des paquets sur <a href="https://social.breizhcamp.org/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a>. Les emails sont envoyés avec une petite coquille discrète dans l'adresse email d'expédition : noreply@pypj.org (pypi -> pypj). À noter que la plateforme elle-même n'a pas été attaquée.- <a href="https://blog.pypi.org/posts/2025-07-28-pypi-phishing-attack/" rel="nofollow noopener" translate="no" target="_blank">https://blog.pypi.org/posts/2025-07-28-pypi-phishing-attack/</a> - <a href="https://fosstodon.org/@ThePSF/114931492211259669" rel="nofollow noopener" translate="no" target="_blank">https://fosstodon.org/@ThePSF/114931492211259669</a>

TechnoTenshi :verified_trans: :Fire_Lesbian:Popular Python package <code>num2words</code> v0.5.15 was flagged as compromised after being published without a GitHub tag. Linked to the "Scavenger" threat actor, it was quickly removed from PyPI. Projects using automated tools may have already pulled the malicious version. Check and downgrade if needed. <a href="https://www.stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise" rel="nofollow noopener" translate="no" target="_blank">https://www.stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise</a><a href="https://infosec.exchange/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> <a href="https://infosec.exchange/tags/SupplyChainSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#SupplyChainSecurity</a> <a href="https://infosec.exchange/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a>

Matthew MartinOkay, someone already implemented my idea (independently) to check npm packages for vulnerabilities before installation.Now someone needs to make the <a href="https://mastodon.social/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#python</a> version so you can see if a package is dodgy before you install in from <a href="https://mastodon.social/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#pypi</a> <a href="https://github.com/lirantal/npq" rel="nofollow noopener" translate="no" target="_blank">https://github.com/lirantal/npq</a>

Seth Larson🚨 Be aware there's a potential phishing campaign likely targeting <a href="https://mastodon.social/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a> / <a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> package maintainers:<a href="https://discuss.python.org/t/phishing-attack/100267" rel="nofollow noopener" translate="no" target="_blank">https://discuss.python.org/t/phishing-attack/100267</a>

bignoseI just received a <a href="https://fosstodon.org/tags/Scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#Scam</a> email from a <a href="https://fosstodon.org/tags/TypoSquatter" class="mention hashtag" rel="nofollow noopener" target="_blank">#TypoSquatter</a>. Sender: noreply@pypj.orgThey're hoping I don't notice the typo for <a href="https://fosstodon.org/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#PyPI</a> (the <a href="https://fosstodon.org/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#Python</a> package index), and asking me to “follow this link to verify your email address”.Don't follow the link, just mark the message as spam and delete it.Be careful out there.

Recent searches

Search options

Administered by:

Server stats:

#pypi