med-mastodon.com is one of the many independent Mastodon servers you can use to participate in the fediverse.
Medical community on Mastodon

Administered by:

Server stats:

347
active users

#pypi

3 posts3 participants0 posts today
Olly 👾<p>:python: <a href="https://nerdculture.de/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> invalidates Tokens stolen in <a href="https://nerdculture.de/tags/GhostAction" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GhostAction</span></a> <a href="https://nerdculture.de/tags/Supply" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Supply</span></a> <a href="https://nerdculture.de/tags/Chain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Chain</span></a> <a href="https://nerdculture.de/tags/Attack" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Attack</span></a></p><p>The Python Software Foundation team has confirming that the threat actors didn't abuse them to publish malware. These tokens are used to publish packages on the PyPI, a software repository that acts as the default source for Python's package management tools.</p><p><a href="https://blog.pypi.org/posts/2025-09-16-github-actions-token-exfiltration/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.pypi.org/posts/2025-09-16</span><span class="invisible">-github-actions-token-exfiltration/</span></a></p><p><a href="https://nerdculture.de/tags/it" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>it</span></a> <a href="https://nerdculture.de/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://nerdculture.de/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>privacy</span></a> <a href="https://nerdculture.de/tags/engineer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>engineer</span></a> <a href="https://nerdculture.de/tags/media" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>media</span></a> <a href="https://nerdculture.de/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>python</span></a> <a href="https://nerdculture.de/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>programming</span></a> <a href="https://nerdculture.de/tags/developer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>developer</span></a> <a href="https://nerdculture.de/tags/tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>tech</span></a> <a href="https://nerdculture.de/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>news</span></a></p>
Scripter<p>Alert ⚠️ Malicious PyPI Package soopsocks Infects 2,653 Systems Before Takedown <a href="https://thehackernews.com/2025/10/alert-malicious-pypi-package-soopsocks.html" rel="nofollow noopener" target="_blank">thehackernews.com/2025/10/aler...</a> <a class="hashtag" rel="nofollow noopener" href="https://bsky.app/search?q=%23Cybercrime" target="_blank">#Cybercrime</a> <a class="hashtag" rel="nofollow noopener" href="https://bsky.app/search?q=%23Python" target="_blank">#Python</a> <a class="hashtag" rel="nofollow noopener" href="https://bsky.app/search?q=%23PyPI" target="_blank">#PyPI</a><br><br><a href="https://thehackernews.com/2025/10/alert-malicious-pypi-package-soopsocks.html" rel="nofollow noopener" target="_blank">Alert: Malicious PyPI Package ...</a></p>
Scripter :verified_flashing:<p>Alert ⚠️ Malicious PyPI Package soopsocks Infects 2,653 Systems Before Takedown<br><a href="https://thehackernews.com/2025/10/alert-malicious-pypi-package-soopsocks.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">thehackernews.com/2025/10/aler</span><span class="invisible">t-malicious-pypi-package-soopsocks.html</span></a> <a href="https://social.tchncs.de/tags/Cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybercrime</span></a> <a href="https://social.tchncs.de/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> <a href="https://social.tchncs.de/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a></p>
Snakemake Release Robot<p>BEEP, BEEP - I am your friendly <a href="https://fediscience.org/tags/Snakemake" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Snakemake</span></a> release announcement bot.</p><p>There is a new release of Snakemake. Its version now is 9.11.8!</p><p>Give us some time, and you will automatically find it on <a href="https://fediscience.org/tags/Bioconda" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Bioconda</span></a> and <a href="https://fediscience.org/tags/Pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Pypi</span></a>.</p><p>If you want to discuss the release, you will find the maintainer here on Mastodon!<br><span class="h-card" translate="no"><a href="https://fosstodon.org/@johanneskoester" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>johanneskoester</span></a></span></p><p>If you discover any issues, please report them on <a href="https://github.com/snakemake/snakemake/issues" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/snakemake/snakemake</span><span class="invisible">/issues</span></a>.</p><p>See <a href="https://github.com/snakemake/snakemake/releases/tag/v9.11.8" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/snakemake/snakemake</span><span class="invisible">/releases/tag/v9.11.8</span></a> for details. Here is the header of the changelog:</p><p>𝑅𝑒𝑙𝑒𝑎𝑠𝑒 𝑁𝑜𝑡𝑒𝑠 (𝑝𝑜𝑠𝑠𝑖𝑏𝑙𝑦 𝑎𝑏𝑏𝑟𝑖𝑔𝑒𝑑):<br>𝐁𝐮𝐠 𝐅𝐢𝐱𝐞𝐬</p><p>* use proper callable when accessing rule proxy with associated path modifier: <a href="https://github.com/snakemake/snakemake/issues/3763" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/snakemake/snakemake</span><span class="invisible">/issues/3763</span></a></p><p>𝐃𝐨𝐜𝐮𝐦𝐞𝐧𝐭𝐚𝐭𝐢𝐨𝐧</p><p>* add snakemake logo to automatic mastodon release posts: <a href="https://github.com/snakemake/snakemake/issues/3764" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/snakemake/snakemake</span><span class="invisible">/issues/3764</span></a></p>
David Zaslavsky<p><span class="h-card" translate="no"><a href="https://mymath.rocks/timeline/" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>helge</span></a></span> I don't think there's a formal reporting mechanism for this. Since PyPI doesn't do anything special when a package is abandoned, there wouldn't be any point.</p><p>If a project being abandoned is causing some sort of particularly dangerous situation, I suppose one could contact the PyPI admins and ask them to do something about it manually. No guarantee on whether they would or not though 🤷 I think they typically take a hands-off approach by default. </p><p><a href="https://techhub.social/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> <a href="https://techhub.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a></p>
Helge<p>Is there a way to report a pypi project as abandonware? </p> <p>Example <a href="https://pypi.org/project/did-plc/" rel="nofollow noopener" target="_blank">did-plc</a>.</p> <p>I see the report as malware button.</p>
Jessica Tegner 👩🏻‍🦰<p>Also.<br>Fun fact.</p><p>As people might know, I maintain "pypandoc".</p><p>But did you know, that 'pypandoc' actually have 2 packages on PyPI?</p><p>The regular 'pypandoc' package that people typically install.<br>And then it also has 'pypandoc_binary' which comes with a version of pandoc packaged - so you can get started right away.</p><p>pypandoc_binary, for the first month, just surpassed 1.000.000 downloads in the last 30 days.</p><p>That's amazing news.<br>That means, that the total pypandoc project has been downloaded over 4.500.000 times over the last month.</p><p>That's amazing - I'm so honored.</p><p><a href="https://caneandable.social/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>python</span></a> <a href="https://caneandable.social/tags/tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>tech</span></a> <a href="https://caneandable.social/tags/pypandoc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypandoc</span></a> <a href="https://caneandable.social/tags/opensci" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>opensci</span></a> <a href="https://caneandable.social/tags/markdown" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>markdown</span></a> <a href="https://caneandable.social/tags/pandoc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pandoc</span></a> <a href="https://caneandable.social/tags/Humblebrag" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Humblebrag</span></a> <a href="https://caneandable.social/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a></p>
Matthew Martin<p><a href="https://mastodon.social/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a> <a href="https://mastodon.social/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>python</span></a> package maintainers are under attack.</p><p><a href="https://www.theregister.com/2025/09/24/pypi_phishing_attacks/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">theregister.com/2025/09/24/pyp</span><span class="invisible">i_phishing_attacks/</span></a></p>
rexi<p><a href="https://openssf.org/blog/2025/09/23/open-infrastructure-is-not-free-a-joint-statement-on-sustainable-stewardship/?ref=news.itsfoss.com" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">openssf.org/blog/2025/09/23/op</span><span class="invisible">en-infrastructure-is-not-free-a-joint-statement-on-sustainable-stewardship/?ref=news.itsfoss.com</span></a></p><p>Joint statement from the stewards of virtually every major package repository - <a href="https://mastodon.social/tags/Mavel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Mavel</span></a>, <a href="https://mastodon.social/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a>, <a href="https://mastodon.social/tags/npm" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>npm</span></a>, <a href="https://mastodon.social/tags/RubyGems" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RubyGems</span></a>, <a href="https://mastodon.social/tags/Rust" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Rust</span></a>, <a href="https://mastodon.social/tags/Eclipse" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Eclipse</span></a>…and others…who serve billions of downloads monthly…</p><p>These registries serve billions, perhaps even trillions, of downloads each month. <a href="https://mastodon.social/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a> companies are <a href="https://mastodon.social/tags/scraping" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>scraping</span></a> entire registries…CI/CD systems hammer servers with wasteful, uncached requests.</p><p>Commercial vendors use public registries as free global CDNs for their proprietary products…</p>
Daemon Silverstein<p><a href="https://calckey.world/tags/NPM" rel="nofollow noopener" target="_blank">#NPM</a> from <a href="https://calckey.world/tags/Node" rel="nofollow noopener" target="_blank">#Node</a><span>.js ended up in the hands of Microsoft.<br><br></span><a href="https://calckey.world/tags/RubyGems" rel="nofollow noopener" target="_blank">#RubyGems</a> from <a href="https://calckey.world/tags/Ruby" rel="nofollow noopener" target="_blank">#Ruby</a><span> ended up in the hands of a nazi libertarian.<br><br>It feels like </span><a href="https://calckey.world/tags/OSS" rel="nofollow noopener" target="_blank">#OSS</a> and <a href="https://calckey.world/tags/FOSS" rel="nofollow noopener" target="_blank">#FOSS</a><span> are being attacked on a daily basis.<br><br>Do anyone have information regarding </span><a href="https://calckey.world/tags/PyPi" rel="nofollow noopener" target="_blank">#PyPi</a> from <a href="https://calckey.world/tags/Python" rel="nofollow noopener" target="_blank">#Python</a>, is it also compromised? As far as I know, PyPi stopped working with <code>pip search</code> ("Use the browser") and the website needs JS to function (because it uses some PoW browser checking), so using Lynx or elinks as a sysadmin on a terminal-only machine in order to search for Python packages have been a no-no. Wonder how much it's due to similar phenomenon going on with Ruby and Node.js ecosystems.</p>
⚯ Michel de Cryptadamus ⚯<p>Released v1.17.0 of The Pdfalyzer, the surprisingly popular tool for analyzing (possibly malicious) PDFs I created after my own unpleasant experience. Now ships with two command line tools for extracting stuff from PDF files:</p><p>1. extract_text_from_pdfs() - brute force extract all text from a PDF, including doing an <a href="https://universeodon.com/tags/OCR" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OCR</span></a> extraction of any embedded images</p><p>2. extract_pdf_pages() - rip a page range from a <a href="https://universeodon.com/tags/PDF" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PDF</span></a> and write them to a new one</p><p>* Github: <a href="https://github.com/michelcrypt4d4mus/pdfalyzer" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/michelcrypt4d4mus/p</span><span class="invisible">dfalyzer</span></a><br>* Pypi: <a href="https://pypi.org/project/pdfalyzer/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">pypi.org/project/pdfalyzer/</span><span class="invisible"></span></a><br>* Homebrew: <a href="https://formulae.brew.sh/formula/pdfalyzer" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">formulae.brew.sh/formula/pdfal</span><span class="invisible">yzer</span></a><br>* Fun thread someone made last week using Pdfalyzer to explain some of how byzantine the PDF format is: <a href="https://x.com/VikParuchuri/status/1965773078585344215" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">x.com/VikParuchuri/status/1965</span><span class="invisible">773078585344215</span></a></p><p><a href="https://universeodon.com/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a> <a href="https://universeodon.com/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>python</span></a> <a href="https://universeodon.com/tags/pdf" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pdf</span></a> <a href="https://universeodon.com/tags/pdfs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pdfs</span></a> <a href="https://universeodon.com/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://universeodon.com/tags/Threatassessment" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Threatassessment</span></a> <a href="https://universeodon.com/tags/maldoc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>maldoc</span></a> <a href="https://universeodon.com/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malwareanalysis</span></a> <a href="https://universeodon.com/tags/homebrew" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>homebrew</span></a> <a href="https://universeodon.com/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://universeodon.com/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://universeodon.com/tags/yararule" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>yararule</span></a> <a href="https://universeodon.com/tags/PdfFies" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PdfFies</span></a></p>
Fastly Devs<p>How do you optimize package delivery for 950,000+ Python developers? Check out how we're using Individual Provider Anycast to power platforms like PyPI, where small improvements × billions of requests = massive impact! <a href="https://mastodon.social/tags/fastforward" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>fastforward</span></a> <a href="https://mastodon.social/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a> <a href="https://www.fastly.com/blog/powering-pypi-with-advanced-traffic-engineering" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">fastly.com/blog/powering-pypi-</span><span class="invisible">with-advanced-traffic-engineering</span></a></p>
Stylus<p>hey <a href="https://social.afront.org/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>python</span></a> <a href="https://social.afront.org/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a> folks -- I made a mistake. what's the best way to proceed? (boosts welcome!)</p><p>I noticed today that I have uploaded the "same" project under two names: <a href="https://pypi.org/project/jepler-circuitpython-udecimal/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">pypi.org/project/jepler-circui</span><span class="invisible">tpython-udecimal/</span></a> and <a href="https://pypi.org/project/circuitpython-jepler-udecimal/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">pypi.org/project/circuitpython</span><span class="invisible">-jepler-udecimal/</span></a> -- apparently I just made a mistake when transitioning from setup.py to pyproject.toml and input the wrong project name.</p>
Matthew Martin<p><a href="https://mastodon.social/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>python</span></a> and <a href="https://mastodon.social/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a> supply chain mitigation for *apps*</p><p>What we (and npm and cargo and so on) need is pipx, except it runs that app in a docker container.</p><p>So I wrote a little script to generate a docker file, transferred the credentials for a secure python proxy to it, build and run the docker file.</p><p>The docker part was hard, but 10% of users, 1% of the time would be able to do it, but that wasn't the worst.</p>
Torbjørn Wikestad<p>I'd love to have someone test my <a href="https://mastodon.world/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> package for a <a href="https://mastodon.world/tags/MCP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MCP</span></a> server for enhancing the experience of using <a href="https://mastodon.world/tags/ClaudeDesktop" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClaudeDesktop</span></a> , meaning adding primarily memorization functionality. It keeps memories private and portable as json files on your machine, much like a "second brain" system based on notes. Looking for testers' feedback before I release it on <a href="https://mastodon.world/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a>. For now it can be pip installed from GitHub.</p><p><a href="https://github.com/TobiSan5/first-mcp" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/TobiSan5/first-mcp</span><span class="invisible"></span></a></p>
ARA Records Ansible<p>ara 1.7.3 has been released !</p><p>It includes some bug fixes as well as brand new features like a built-in auto-refresh and an ara_label <a href="https://fosstodon.org/tags/Ansible" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Ansible</span></a> module.</p><p>It is already available on <a href="https://fosstodon.org/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> and container images as well as the <a href="https://fosstodon.org/tags/Fedora" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Fedora</span></a> package will follow eventually.</p><p>Release notes are available in the repository's git tags as well as in the documentation: <a href="https://codeberg.org/ansible-community/ara/releases/tag/1.7.3" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">codeberg.org/ansible-community</span><span class="invisible">/ara/releases/tag/1.7.3</span></a></p><p>Enjoy !</p>
Jezus Michał ⛰ (on)<p>Przygotowałem wstępnie weryfikację autentyczności plików z <a href="https://pol.social/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> dla <a href="https://pol.social/tags/Gentoo" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Gentoo</span></a>.</p><p>Wiecie, ten nowy wynalazek, który chroni przed atakami podmieniającymi pliki na PyPI, i upewnia się, że macie do czynienia z oryginalnymi plikami z GitHuba. No bo, jak powszechnie wiadomo, repozytoria na GitHubie i tamtejsze systemy CD są mało prawdopodobnym celem ataków. No i absolutnie nie trzeba się martwić tym, że klucze, repozytoria i te systemy CD są w rękach Microsoftu.</p><p><a href="https://github.com/gentoo/gentoo/pull/43549" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/gentoo/gentoo/pull/</span><span class="invisible">43549</span></a></p><p><a href="https://pol.social/tags/bezpiecze%C5%84stwo" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bezpieczeństwo</span></a> <a href="https://pol.social/tags/GitHub" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GitHub</span></a> <a href="https://pol.social/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft</span></a> <a href="https://pol.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> <a href="https://pol.social/tags/SigStore" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SigStore</span></a></p>
mgorny-nyan (he) :autism:🙀🚂🐧<p>I've drafted support for verification of <a href="https://social.treehouse.systems/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> provenance for <a href="https://social.treehouse.systems/tags/Gentoo" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Gentoo</span></a>.</p><p>You know, the new fancy thing that protects against supply chain attacks on PyPI, and verifies that you're using genuine <a href="https://social.treehouse.systems/tags/GitHub" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GitHub</span></a> artifacts. Because, you know, GitHub repositories and deployment pipelines are an unlikely attack vector. And you definitely don't need to worry about <a href="https://social.treehouse.systems/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft</span></a> owning the keys, the repositories and the pipelines at all.</p><p><a href="https://social.treehouse.systems/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://social.treehouse.systems/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a></p>
Marcel SIneM(S)US<p><a href="https://social.tchncs.de/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> geht gegen <a href="https://social.tchncs.de/tags/DomainHijacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DomainHijacking</span></a> vor und prüft Mail-Adressen | Developer <a href="https://www.heise.de/news/PyPI-geht-gegen-Domain-Hijacking-vor-und-prueft-Mail-Adressen-10552920.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">heise.de/news/PyPI-geht-gegen-</span><span class="invisible">Domain-Hijacking-vor-und-prueft-Mail-Adressen-10552920.html</span></a> <a href="https://social.tchncs.de/tags/SupplyChainAttack" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SupplyChainAttack</span></a> <a href="https://social.tchncs.de/tags/SupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SupplyChain</span></a></p>
Hugo van Kemenade<p><a href="https://pypistats.org" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">pypistats.org</span><span class="invisible"></span></a> is back online! 🚀📈</p><p>Thanks to <span class="h-card" translate="no"><a href="https://publicidentity.net/@jezdez" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>jezdez</span></a></span> for suggesting the <span class="h-card" translate="no"><a href="https://fosstodon.org/@ThePSF" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>ThePSF</span></a></span> takes stewardship and connecting the right people, to <span class="h-card" translate="no"><a href="https://mastodon.social/@EWDurbin" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>EWDurbin</span></a></span> for migrating, and of course to Christopher Flynn for creating and running it for all these years!</p><p><a href="https://github.com/psf/pypistats.org" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/psf/pypistats.org</span><span class="invisible"></span></a><br><a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> <a href="https://mastodon.social/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> <a href="https://mastodon.social/tags/pypistats" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypistats</span></a> <a href="https://mastodon.social/tags/stats" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>stats</span></a></p>