News for hackers. Stuff that matters.
Re:Malicious PyPI packages stealing credit cards and injecti... by actually_a_dog on Tuesday August 03, 2021 @02:06PM (#28052200)
Yep. You should also be hosting and deploying from wheels[0], even for stuff you create internally. If you're doing it right, you'll end up hosting your own internal PyPi server[1], which, luckily, isn't hard[2].

We did this at one of my previous companies, and, of all the things that ever went wrong with our deploy processes, our internal PyPi server was literally never the culprit.

---

[0]: https://pythonwheels.com/

[1]: https://github.com/testdrivenio/private-pypi

[2]: https://testdriven.io/blog/private-pypi/

There are no comments on this comment yet.