Third-party Python packages are essential for many projects, but every dependency introduces potential supply-chain risk. Private repositories, vulnerability scanning, curated packages, and stricter review policies can all help,…
Third-party Python packages are incredibly useful, but every dependency introduces potential supply-chain risk. Private repositories, vulnerability scanning, dependency pinning, and stricter reviews can help, yet they may also…
We had a near miss where an automated assistant suggested a dependency whose name differed from a legitimate package by only one character. It had a single maintainer,…
We had a close call where an assistant suggested a dependency whose name differed from the legitimate package by one character. The package had almost no maintainer history,…
PyPI's package filtering and popularity signals don't seem sufficient anymore. A recent supply-chain incident involving a popular machine-learning ecosystem package showed that even widely used community projects can…