News for hackers. Stuff that matters.

A comment on Investigating a backdoored PyPI package targeting FastAPI applications. Parent comment

Re:Investigating a backdoored PyPI package targeting FastAPI... by christophetd on Thursday November 24, 2022 @03:12PM (#33735696)
The malicious commit (2cd2223dcd90fa9d9c72851427602aa0e179e061) was not signed. Sorry you feel like the writing isn't frank.
[ Parent | on HN ]
Re:Investigating a backdoored PyPI package targeting FastAPI... by denton-scratch on Thursday November 24, 2022 @03:50PM (#33736080)
Apologies; I am not a git user. I thought every git commit was signed, excuse my ignorance. I'm surprised something in PyPi can be shipped without any signatures, but I'm not shocked; I'm not a fan of language-specific repositories. NPM is an example of what I'm not a fan of.
[ Parent | on HN ]