Trusted registries are widely treated as a key component of Software Bill of Materials (SBOM) - driven supply chain security ...

Operation Dream Job is evolving once again, and now comes through malicious dependencies on bare-bones projects.

网络安全研究人员发现，与朝鲜相关的Lazarus组织在npm和Python包索引(PyPI)仓库中投放了一批新的恶意软件包，这些软件包与一个虚假招聘主题活动有关。 这一协调攻击活动被命名为graphalgo，名称来源于在npm注册表中发布的第一个软件包。据评估，该活动自2025年5月以来一直处于活跃状态。 ReversingLabs研究员Karlo Zanki在报告中表示："攻击者通过Linked ...

Researchers have revealed that bad actors are targeting dYdX and using malicious packages to empty its user wallets.

The Python Software Foundation has warned victims of a new wave of phishing attacks using a fake Python Package Index (PyPI) website to reset credentials. Accessible at pypi.org, PyPI is the default ...

Cybersecurity researchers have found harmful software in the official Python Package Index (PyPI) and npm package repositories, putting software supply chains at risk. The packages, called termncolor ...

Abstract: Python is the top popular programming language used in the open-source community, largely owing to the extensive support from diverse third-party libraries within the PyPI ecosystem.

The administrators of the Python Package Index (PyPI) have begun an effort to improve the hundreds of thousands of software packages that are listed. The attempt, which began earlier last year, is to ...

When attackers compromised Ultralytics YOLO, a popular real-time object detection machine-learning package for Python, most assumed the Python Package Index, or PyPI, must be the point of failure.

The administrators of the Python Package Index (PyPI) repository have quarantined the package "aiocpa" following a new update that included malicious code to exfiltrate private keys via Telegram. By ...

Users of popular cryptocurrency wallets have been targeted in a supply chain attack involving Python packages relying on malicious dependencies to steal sensitive information, Checkmarx warns. As part ...