Posted by ramimac 3 days ago
https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-...
Does the package have a user base, or did the malicious team target one of the many useless GitHub repos?
That's incorrect, the repo and package date back to 2019
Not that I had the option anyway, because everything using Python breaks if you update it. You know they've given up on backward comparability and version control, when the solution is: run everything in a VM, with its own installation. Apparently it's also needed for security, but the VMs aren't really set up to be secure.
I don't get why everything math heavy uses it. I blame MATLAB for being so awful that it made Python look good.
It's not even the language itself, not that it doesn't have its own issues, or the inefficient way it's executed, but the ecosystem around it is so made out of technical debt.
It's a pandemic, I will be hardening my security, and rotating my keys just in case.
uv taking over basically ensures that dependencies won't become managed properly and nothing will work without uv
It's the closest language to pseudocode that exists.
Like every other language from 1991, it has rough edges.
venv and Docker don't fix much. They just freeze the mess until rebuild day, when you find out half the stack depended on an old wheel, a dead maintainer, or a C extension that no longer compiles on a current Python.
Supply-chain security is such a dumpster fire, and threat actors are realising that they can use LLMs to organize such attacks.