<story><title>3500 packages uploaded to PyPI, pointing to a malicious URL</title><url>https://twitter.com/DataNerdery/status/1366263351685226499</url></story><parent_chain></parent_chain><comment><author>macksd</author><text>One of the things that the recent Python cryptography debate has highlighted to me is how much we depend on this distribution of libraries like this. In that case, it&amp;#x27;s normal to just automatically get updates from a product and then one day, a whole bunch of software projects suddenly notice and, luckily, break (lucky, as opposed to being compromised). In this case, it&amp;#x27;s normal to just type a project name in install software, with very little vetting done by many people. I want to work on someone&amp;#x27;s web app, npm suddenly downloads the world. Who&amp;#x27;s actually audited all that? I know I haven&amp;#x27;t.&lt;p&gt;Not sure how we could fix it without slowing way down and doing a lot more work.</text></comment>
<story><title>3500 packages uploaded to PyPI, pointing to a malicious URL</title><url>https://twitter.com/DataNerdery/status/1366263351685226499</url></story><parent_chain></parent_chain><comment><author>CapriciousCptl</author><text>Here’s cupy’s postmortem— 
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;cupy&amp;#x2F;cupy&amp;#x2F;issues&amp;#x2F;4787&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;cupy&amp;#x2F;cupy&amp;#x2F;issues&amp;#x2F;4787&lt;/a&gt;&lt;p&gt;Salient points being that cupy releases a new named package for each cuda version, so future package names are of course predictable. Since PyPi doesn’t allow namespacing, cupy’s plan is to register new names ASAP when cuda releases a new version and monitor and report other packages purporting to be cupy that get uploaded.</text></comment>