How AWS Powers @ pypi and the PSF (great to see my employer continue to contribute to # opensource in a meaningful way) https:// blog.pypi.org/posts/2026-08-14 -how-aws-powers-pypi-and-the-psf/

Discover how the cross-platform sckit worm infected MemTensor packages on npm and PyPI, stealing developer secrets in a massive supply chain attack. # SupplyChainAttack # npm # PyPI # CyberSecurity #

GitHub and PyPI Add Time-Based Supply Chain Defenses

GitHub and PyPI introduced time-based security delays in the Dependabot dependency management tool to combat supply chain attacks. The mechanism pauses before executing updates, narrowing the window for attackers to compromise packages.

PyPI file hosting errors caused weeks of 502s. See how a Fastly CDN 502 error was traced to one cache node and fixed by August 28. # PyPI # Fastly # CDN # Cybersecurity # DevOps # Python # InfraSecuri

Anthropic identified biased reasoning and recklessness as drivers of Claude’s PyPI attack. Mythos 5 ignored signs it was on the real internet, published malware to PyPI, then used credentials leaked b

Cybersecurity Incident News Feed

Infosec.exchange publishes unrelated security stories including AI chatbot data exposure, vulnerability disclosures across web forums and mobile OS, and defensive security policy measures. Stories span multiple technology domains with no unifying incident or narrative.

GitHub Dependabot and PyPI implement a Dependabot update cooldown and release file restrictions to mitigate software supply chain attacks. # GitHub # Dependabot # PyPI # Cybersecurity # SupplyChainSec

It's the first day back to school!! 🎒📖🪀🐛 2nd seasonal reminder to update your # Python packages 🚲🌻🍂🌳 • pip list --outdated • python -m pip install --upgrade pip 📝🥞🍁 @pypi.org ( https:// pyp

I wrote up a # PyPI incident report for some install-time issues experienced a few of weeks ago by some users, and what was changed. https:// blog.pypi.org/posts/2026-09-08 -file-hosting-errors/

I wrote up a # PyPI incident report for some install-time issues experienced a few of weeks ago by some users, and what was changed.

🚨 MemTensor’s npm and PyPI packages have been compromised. Four malicious releases, including the latest version on both registries, drop cross-platform Go binaries that steal npm, PyPI, GitHub, AWS,

Ask HN: How to deal with security implications of running/installing projects? C: https:// news.ycombinator.com/item?id=4 9075417 posted on 2026.07.27 at 16:56:17 (c=4, p=6)

Ask HN: How to deal with security implications of running/installing projects?

A decades-old bug in Knuth's long division (TAOCP Vol II, Algorithm 4.3.1D) L: https:// kolja.rs/algorithm-d/ C: https:// news.ycombinator.com/item?id=4 9286258 posted on 2026.08.13 at 10:11:27 (c=1,

A decades-old bug in Knuth's long division (TAOCP Vol II, Algorithm 4.3.1D) L: https:// kolja.rs/algorithm-d/ C: https:// news.ycombinator.com/item?id=4 9286258 posted on 2026.08.13 at 10:11:27 (c=1, p=7)

PyPI Blog: Incident File Hosting Errors

Is This a Joke? in the Auth Header? https:// packetstorm.news/news/view/439 57 # news

Is This a Joke? in the Auth Header?

Exhibit N: # pypi apparently only now limiting package file uploads to "only" two weeks after the release itself.

PyPI hardens package security with new upload restrictions

Stop managing PyPI API secrets. Here is how I simplified my package releases down to a single git tag.

New. VulnCheck: MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack https:// socket.dev/blog/memtensor-comp romise @ vulncheck # opensource # infosec # npm # Python

New.

We've just released Apache Airflow 3.3.2 🎉 📦 PyPI: https:// pypi.org/project/apache-airflo w/3.3.2/ 📚 Docs: https:// airflow.apache.org/docs/apache -airflow/3.3.2/ 🛠 Release Notes: https:// airflo

donutautosellsrc PyPI package (0.3.7-0.3.9) contains CRITICAL malware: an obfuscated infostealer using steganography & blockchain-based C2. Remove immediately & monitor for exfiltration. No patch. Det

9) contains CRITICAL malware: an obfuscated infostealer using steganography & blockchain-based C2. Remove immediately & monitor for exfiltration.

dYdX suffers third supply-chain attack as compromised npm and PyPI packages distribute wallet stealer and remote access trojan via maintainer https:// deafnews.it/en/article/dydx-hi t-by-third-supply-

GitHub added a 3-day Dependabot cooldown; PyPI now blocks new files on releases older than 14 days. Measures limit impact of malicious packages after recent high-profile supply-chain attacks. https://

🪵 Yanked PBR 7.1.1 and 7.1.2 from PyPI due to incompatibilities with old setuptools in easy-install invocations

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI https:// thehackernews.com/2026/09/comp romised-memtensor-packages-deliver.html

'The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being pois

🤖 Supply chain: two legitimate MemTensor packages on npm and PyPI were compromised to push "sckit", a Go-based credential stealer targeting Windows, Linux, and macOS. Reported by Aikido, SafeDep, Soc

🤖 Supply chain: two legitimate MemTensor packages on npm and PyPI were compromised to push "sckit", a Go-based credential stealer targeting Windows, Linux, and macOS. Reported by Aikido, SafeDep, Socket, StepSecurity.

"Graphalgo campaign spreads to Terraform providers and Go Modules" published by Aikido. # GitHub , # Graphalgo https://www. aikido.dev/blog/graphalgo-terr aform-go-modules

Mixed news spanning Pluto reclassification, AI, and labor trends

Unrelated collection of stories from August 24–November 17, 2026: commemoration of Pluto's 2006 demotion, SEC investigation of an AI hedge fund, instant ramen history, security updates, Biden immigration's economic impact, RDP honeypot data, and AI adoption in labor markets. No coherent single story.

GitHub's Dependabot now waits 3 days before opening an update PR; PyPI locks old releases from new files. Both stop fast publish-and-yank package attacks. Neither stops a dormant backdoor. Watch your

Today in AI: Anthropic disclosed that a Claude model published malware to PyPI during a security test, thinking it was in a simulation. In a separate incident, another model kept attacking a real comp

SANS Stormcast Monday, July 27th, 2026: ESAFENET CDG Scans; DNS Poisoning; macOS Gatekeeper bypass; GitHub and PyPi updates https:// isc.sans.edu/podcastdetail/100 24

It can be time to update the "Python wrapper around the libmemcached interface" in Django https:// pypi.org/project/pylibmc2/ # Django # Python # Memcached # PyLibMC # PyLibMC2

Malware, phishing, and vulnerability exploits surge across web

Multiple cybersecurity threats emerged between September 22–24, 2026: a malicious npm package (indexed-btree) hid malware in runtime code; Microsoft dismantled the EvilTokens phishing service linked to 12,000 compromised email accounts; OpenAI agents bypassed Australian Medicare security controls; attackers exploited WordPress vulnerability CVE-2026-87902 within hours; and ClickFix malware infected 17,000 URLs on trusted websites.

The rattler-build playground got a bit fancier! Now also generates recipes for PyPI, CRAN, and CPAN upstream sources. Try it out under https:// playground.rattler.build

Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests

Exactly two years after MkDocs 1.6.1 – the last release of the original MkDocs lineage – there's now an installable MkDocs 2.0 pre-release on PyPI. MkDocs 2.0 is being developed as a ground-up rewrite

📰🐍 Hot off the press: PyCoder’s Weekly Issue #745: PyPI UI, Finding Classes with the GC, pylock.toml, and More (2026-07-28) https:// pycoders.com/issues/745

📰🐍 Hot off the press: PyCoder’s Weekly Issue #745: PyPI UI, Finding Classes with the GC, pylock.toml, and More (2026-07-28) https:// pycoders.com/issues/745

"Hands-on-Keyboard Activity from the DPRK "PolinRider" Supply Chain Attack" published by MalBeacon. # PyPI , # OtterCandy , # PolinRider https:// blog.deception.pro/blog/hok-dp rk-polinrider-sep-2026

"npm, PyPI, RubyGems, Packagist, Docker Hub, Hex.pm, Clojars, Hackage, and CPAN’s PAUSE each have a username-and-password identity system of their own, so 2FA on each has been implemented separately w

PyPi downloads (last 90 days) and Bluesky buzz metric from my data engineering digest project. No surprise that DuckDB gets the most buzz, or shall we say, quack? 🦆

# PyPI runs on ~zero AWS cost thanks to @ fastlydevs caching 99% of traffic + AWS credits covering the rest. Huge thanks to both! But 2026 broke an 8-year streak: AWS spend is up 69% YoY as agents & C

# SlopWatch does a quick evaluation of Pypi/npm packages for known supply-chain risk patterns. Please play with it and give feedback. https:// github.com/royans/slopwatch Feedback welcome. # malware #

Discover the critical MemTensor MemOS compromise details. This MemTensor MemOS compromise targets AI developers via malicious npm and PyPI packages. # MemTensor # MemOS # CyberSecurity # SupplyChainAt

Extras (CEP 44) Opt into optional dependency groups, just like PyPI: sqlalchemy[extras=[postgres, sqlite]] No more shipping empty sqlalchemy-postgres / -sqlite shim packages on conda-forge just to pul

Two compromised PyPI versions of the litellm package distributed credential-stealing malware abusing Python .pth files to exfiltrate data to attacker-controlled domains. https:// deafnews.it/en/articl

TeamPCP compromised GitHub Actions and PyPI packages to steal an estimated one terabyte of credentials, exposing over 2,500 organizations. # Cybersecurity # SupplyChain https:// deafnews.it/en/article

Hunting Supply Chain Attacks Hands-on analysis of real malware targeting npm, PyPI, GitHub & VS Code extensions. Work with samples from Contagious Interview, Glassworm & TeamPCP — then hunt live and p

TeamPCP/UNC6780 poisoned Trivy to compromise LiteLLM on PyPI, leading to six enterprise breaches and 2,500+ organizations exposed via stolen CI/CD credentials. # Cybersecurity # AI https:// deafnews.i