<story><title>Malicious Python libraries found and removed from PyPI</title><url>https://www.zdnet.com/article/twelve-malicious-python-libraries-found-and-removed-from-pypi/</url></story><parent_chain></parent_chain><comment><author>ris</author><text>Ah, wild west package repositories...&lt;p&gt;Only yesterday the developers of Itsdangerous went and &lt;i&gt;deleted&lt;/i&gt; their recently-released 1.0.0 version. That&amp;#x27;s right. Deleted. Gone. Anyone who made the upgrade and for some insane reason were using pip in their release pipeline suddenly had an un-deployable app.&lt;p&gt;And people complain that they don&amp;#x27;t want maintainers &amp;quot;getting in the way&amp;quot; between them and developers.</text></comment>
<story><title>Malicious Python libraries found and removed from PyPI</title><url>https://www.zdnet.com/article/twelve-malicious-python-libraries-found-and-removed-from-pypi/</url></story><parent_chain></parent_chain><comment><author>JackC</author><text>Another pypi issue I&amp;#x27;ve been wondering about recently is binary wheels. We saw an issue a few weeks back where pipenv hashes stopped matching because binary wheels were added for a package years after the last release, and it wasn&amp;#x27;t immediately obvious how to check if they were legitimate. It would be nice if there was some automated scan to check that binary builds match the source.&lt;p&gt;I think there have been some python package reproducible build efforts at Debian, and there&amp;#x27;s a standard image for building wheels, so maybe that&amp;#x27;s somewhat possible?</text></comment>