News for hackers. Stuff that matters.

A comment on Malicious PyPI packages stealing credit cards and injecting code. Parent comment

Re:Malicious PyPI packages stealing credit cards and injecti... by ozzythecat on Tuesday August 03, 2021 @11:36AM (#28050463)
It’s not 100% bullet proof, but it’s safer than pulling any random repos directly from the internet.

It’s also good that your business doesn’t have to rely on a third party every time you need to pull down your dependencies and build your software.

[ Parent | on HN ]
Re:Malicious PyPI packages stealing credit cards and injecti... by DSingularity on Tuesday August 03, 2021 @12:04PM (#28050848)
Protects you against a dependency being hijacked and retroactively embedding malware in prior versions . Check summing would protect against that without the trouble of manually hosting the dependency.
[ Parent | on HN ]