News for hackers. Stuff that matters.

A comment on 3500 packages uploaded to PyPI, pointing to a malicious URL. Parent comment

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by katbyte on Tuesday March 02, 2021 @03:47PM (#26320430)
> People shouldn’t randomly download packages without understanding and verifying EVERY one

yes but people do and all the training in the worldn't isn't going to help - the package manager needs safe defaults that prevent this sort of thing.

[ Parent | on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by prepend on Tuesday March 02, 2021 @05:13PM (#26321750)
What can the package manager do to prevent someone from typing in the wrong package name?

There are some package managers like R’e CRAN that are really thorough on what gets in, so maybe if pypi got more volunteers they could start a “tested” tier where updated require test suites and whatnot.

[ Parent | on HN ]