Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by nxpnsv on Tuesday March 02, 2021 @03:45PM
(#26320400)
Well you probably know your top level requirements, but what about their dependencies, and subsequent dependencies? I guess it could happen that a popular package gets corrupted. My current notebook venv has 87 packages installed, I can't vouch for all of them...
[ Parent
| on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL
by prepend on Tuesday March 02, 2021 @05:11PM
(#26321722)
For production uses, I check them all. It’s a pain, but not that hard to do.
I also use dependency checkers that monitor al those various packages for CVEs related to particular versions. I think I typically catch them during dev and GitHub does a pretty good job of detecting and even suggesting updates.
There is a risk that a package gets corrupted at a used version, but I think that’s fairly small and would be detected quickly. But I think that’s similar to what would happen if Microsoft or Apple put out a bad update. And pypi is policed better than commercial setups that don’t have checks and balances (eg, SolarWinds)