News for hackers. Stuff that matters.

A comment on Dozens of malicious PyPI packages discovered targeting developers. Parent comment

Re:Dozens of malicious PyPI packages discovered targeting de... by ashishbijlani on Wednesday November 02, 2022 @04:16PM (#33442339)
Packj sandbox [1] offers "safe installation" of PyPI/NPM/Rubygems packages. It shows you a preview of file system changes that installation will make and can also block arbitrary network communication during installation (uses an allow-list). Disclaimer: I've been building Packj for over an year now.

1. https://github.com/ossillate-inc/packj/blob/main/packj/sandb...

[ Parent | on HN ]
Re:Dozens of malicious PyPI packages discovered targeting de... by collinmanderson on Thursday November 03, 2022 @11:36AM (#33452656)
Only secures installation, not runtime, but still helpful. I'm not a package maintainer, but I do wish that packages were not allowed to run any code at install-time.
[ Parent | on HN ]