News for hackers. Stuff that matters.

A comment on 3500 packages uploaded to PyPI, pointing to a malicious URL. Parent comment

Re:3500 packages uploaded to PyPI, pointing to a malicious URL by alfiedotwtf on Tuesday March 02, 2021 @08:14PM (#26323484)
> Also if you're auditing, wouldn't you audit all dependencies?

What’s the point of a transitive dependency can pull the rug out from under your audio with a single update

[ Parent | on HN ]
Re:3500 packages uploaded to PyPI, pointing to a malicious URL by remram on Wednesday March 03, 2021 @12:33AM (#26325135)
Don't update without auditing the new versions? I don't understand.
[ Parent | on HN ]