So who is responsible for ensuring the code is secure? The volunteer maintainers at PyPI are doing their best. But it is a company’s decision to allow that code from a stranger on the Internet to be used in the applications they build for profit. The purpose of package managers like PyPI is to provide a platform for developers to share their code. If you don’t look closely at what you’re installing, you won’t see malware coming until it’s too late.Īs Pete Morgan, Co-founder and CSO at Phylum, a software supply chain security company, said, “The dynamics between software, security, and business are changing. Package managers, such as Python’s default manager pip, use PyPI as their default source for packages and their dependencies. Users are also cavalier about using PyPI code. Adding salt to the wound, ChatGPT and other Generative AI tools have made it child’s play to create malicious code. The root problem is that Python is used extensively in many problems, and PyPI, with a full-time staff of two people and relatively little automation, simply doesn’t have the resources to deal with securing its code repository. The Python Software Foundation (PSF) received three subpoenas for PyPI user data. PyPI isn’t the only one to notice the user trouble. More recently, PyPI had to stop new user registrations and project creations because of a flood of malicious users. Earlier this year, the FortiGuard team discovered zero-day malware in three PyPI packages called “ colorslib ,” “ httpslib ,” and “libhttps.” Before that, 2022 closed with PyTorch-nightly on Linux being poisoned with a fake dependency. The Python Package Index (PyPI), is the most popular Python programming language software repository.

Amazon 2fa yubikey