3500 packages uploaded to PyPI, pointing to a malicious URL

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by rossdavidh on Tuesday March 02, 2021 @09:31AM (#26315662)

1) surely there's a better way to draw attention to this kind of risk...right? 2) I admit they have my attention, but now what?

[ Parent | on HN ]

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by Isinlor on Tuesday March 02, 2021 @10:56AM (#26316605)

Add namespaces? Block adding new packages that are not named "vendor-packagename" and ensure that only one entity can own a vendor name.

[ Parent | on HN ]

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by warmwaffles on Tuesday March 02, 2021 @09:50AM (#26315872)

Causes development teams to update roles on who is allowed to do what and package signing.

[ Parent | on HN ]