masto.es es uno de los varios servidores independientes de Mastodon que puedes usar para participar en el fediverso.
Bienvenidos a masto.es, el mayor servidor de Mastodon para hispanohablantes de temática general. Registros limitados actualmente a invitaciones.

Administrado por:

Estadísticas del servidor:

1,9 K
usuarios activos

#pypi

3 publicaciones3 participantes0 publicaciones hoy
TechnoTenshi :verified_trans: :Fire_Lesbian:<p>Popular Python package <code>num2words</code> v0.5.15 was flagged as compromised after being published without a GitHub tag. Linked to the "Scavenger" threat actor, it was quickly removed from PyPI. Projects using automated tools may have already pulled the malicious version. Check and downgrade if needed. </p><p><a href="https://www.stepsecurity.io/blog/supply-chain-security-alert-num2words-pypi-package-shows-signs-of-compromise" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">stepsecurity.io/blog/supply-ch</span><span class="invisible">ain-security-alert-num2words-pypi-package-shows-signs-of-compromise</span></a></p><p><a href="https://infosec.exchange/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> <a href="https://infosec.exchange/tags/SupplyChainSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SupplyChainSecurity</span></a> <a href="https://infosec.exchange/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a></p>
Seth Larson<p>🚨 Be aware there's a potential phishing campaign likely targeting <a href="https://mastodon.social/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> / <a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> package maintainers:</p><p><a href="https://discuss.python.org/t/phishing-attack/100267" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">discuss.python.org/t/phishing-</span><span class="invisible">attack/100267</span></a></p>
bignose<p>I just received a <a href="https://fosstodon.org/tags/Scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Scam</span></a> email from a <a href="https://fosstodon.org/tags/TypoSquatter" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TypoSquatter</span></a>. Sender: noreply@pypj.org</p><p>They're hoping I don't notice the typo for <a href="https://fosstodon.org/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> (the <a href="https://fosstodon.org/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> package index), and asking me to “follow this link to verify your email address”.</p><p>Don't follow the link, just mark the message as spam and delete it.</p><p>Be careful out there.</p>
Jason Weatherly<p>After some refactoring, learning about `hatch`, moving more files around, and generally abusing `test.pypi.org`: I've uploaded `diceparse` to PyPI. Still need to update the web documentation, but it now feels like a proper project at this point.</p><p>I still need to add a CLI part so you can just roll dice after installing the package, but I'll handle that later. Also need to tweak the README.md a bit as well...</p><p><a href="https://social.linux.pizza/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>python</span></a> <a href="https://social.linux.pizza/tags/diceparse" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>diceparse</span></a> <a href="https://social.linux.pizza/tags/dice" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>dice</span></a> <a href="https://social.linux.pizza/tags/ttrpg" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ttrpg</span></a> <a href="https://social.linux.pizza/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a></p>
Erik-Jan<p>I was annoyed that there is no "expand_grid()" function in :python: <a href="https://fosstodon.org/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> as in :rstats: <a href="https://fosstodon.org/tags/RStats" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RStats</span></a> <a href="https://fosstodon.org/tags/tidyverse" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>tidyverse</span></a> </p><p>So I just published a small package on <a href="https://fosstodon.org/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> !</p><p>Introducing polarsgrid<br><a href="https://pypi.org/project/polarsgrid/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">pypi.org/project/polarsgrid/</span><span class="invisible"></span></a></p><p>Using the excellent <a href="https://fosstodon.org/tags/polars" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>polars</span></a> 🐻‍❄️ package, easily create a table with product of factors: </p><p>from polarsgrid import expand_grid<br>expand_grid(a=[1, 2, 3], b=["x", "y"])</p><p>Yields all combinations of its inputs as a <a href="https://fosstodon.org/tags/DataFrame" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DataFrame</span></a></p><p>It can also produce a <a href="https://fosstodon.org/tags/LazyFrame" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LazyFrame</span></a> for streaming extra-big tables to disk</p>
⚯ Michel de Cryptadamus ⚯<p>Just published version 1.16.6 of The Pdfalyzer, the surprisingly popular tool for analyzing (possibly malicious) PDFs I created after my own unpleasant encounter with such a creature. Includes a (kind of janky) <a href="https://universeodon.com/tags/YARA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>YARA</span></a> rule for <a href="https://universeodon.com/tags/GIFTEDCROOK" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GIFTEDCROOK</span></a> infostealer PDFs.</p><p>* Github: <a href="https://github.com/michelcrypt4d4mus/pdfalyzer" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/michelcrypt4d4mus/p</span><span class="invisible">dfalyzer</span></a><br>* Pypi: <a href="https://pypi.org/project/pdfalyzer/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">pypi.org/project/pdfalyzer/</span><span class="invisible"></span></a><br>* Homebrew: <a href="https://formulae.brew.sh/formula/pdfalyzer" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">formulae.brew.sh/formula/pdfal</span><span class="invisible">yzer</span></a></p><p><a href="https://universeodon.com/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a> <a href="https://universeodon.com/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>python</span></a> <a href="https://universeodon.com/tags/pdf" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pdf</span></a> <a href="https://universeodon.com/tags/pdfs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pdfs</span></a> <a href="https://universeodon.com/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://universeodon.com/tags/Threatassessment" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Threatassessment</span></a> <a href="https://universeodon.com/tags/maldoc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>maldoc</span></a> <a href="https://universeodon.com/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malwareanalysis</span></a> <a href="https://universeodon.com/tags/homebrew" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>homebrew</span></a> <a href="https://universeodon.com/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://universeodon.com/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://universeodon.com/tags/yararule" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>yararule</span></a></p>
Matthew Martin<p><a href="https://mastodon.social/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>python</span></a> <a href="https://mastodon.social/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a> the name apocalypse is coming - all the good names are taken</p>
OTX Bot<p>PyPI Malware Exploits Instagram Growth Tools to Harvest Credentials</p><p>Pulse ID: 68496f698c9d93ca338f0790<br>Pulse Link: <a href="https://otx.alienvault.com/pulse/68496f698c9d93ca338f0790" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">otx.alienvault.com/pulse/68496</span><span class="invisible">f698c9d93ca338f0790</span></a> <br>Pulse Author: cryptocti<br>Created: 2025-06-11 11:58:33</p><p>Be advised, this data is unverified and should be considered preliminary. Always do further verification.</p><p><a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfoSec</span></a> <a href="https://social.raytec.co/tags/Instagram" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Instagram</span></a> <a href="https://social.raytec.co/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Malware</span></a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OTX</span></a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenThreatExchange</span></a> <a href="https://social.raytec.co/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bot</span></a> <a href="https://social.raytec.co/tags/cryptocti" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cryptocti</span></a></p>
Sebastian<p>Paquetes maliciosos de <a href="https://chilemasto.casa/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a>, <a href="https://chilemasto.casa/tags/npm" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>npm</span></a> y <a href="https://chilemasto.casa/tags/Ruby" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Ruby</span></a> se han encontrado en ataques continuos a la <a href="https://chilemasto.casa/tags/supplychain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>supplychain</span></a> de código abierto <br><a href="https://blogs.masterhacks.net/noticias/hacking-y-ciberdelitos/paquetes-maliciosos-de-pypi-npm-y-ruby-se-encontraron-en-ataques-continuos-a-la-cadena-de-suministro-de-codigo-abierto/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blogs.masterhacks.net/noticias</span><span class="invisible">/hacking-y-ciberdelitos/paquetes-maliciosos-de-pypi-npm-y-ruby-se-encontraron-en-ataques-continuos-a-la-cadena-de-suministro-de-codigo-abierto/</span></a></p>
Frederik Elwert<p>You want to use a <a href="https://fedihum.org/tags/StaticSiteGenerator" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>StaticSiteGenerator</span></a> and need to support <a href="https://fedihum.org/tags/multilingual" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>multilingual</span></a> sites? It’s now easier than ever! For quite a while, <a href="https://fedihum.org/tags/Pelican" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Pelican</span></a> had a great plugin for that use case. Now I helped migrate it to the new plugin format, which means that it can easily be installed from <a href="https://fedihum.org/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a>. <a href="https://github.com/pelican-plugins/i18n-subsites" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/pelican-plugins/i18</span><span class="invisible">n-subsites</span></a> <a href="https://fedihum.org/tags/MultilingualDH" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MultilingualDH</span></a> <a href="https://fedihum.org/tags/MinimalComputing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MinimalComputing</span></a></p>
OTX Bot<p>PyPI Supply Chain Attack Uncovered: Colorama and Colorizr Name Confusion</p><p>A malicious package campaign targeting Python and NPM users on Windows and Linux has been discovered. The attack uses typo-squatting and name-confusion tactics against the popular colorama Python package and the similar colorizr JavaScript package. Multiple packages with risky payloads were uploaded to PyPI, using names similar to legitimate packages in both PyPI and NPM. The unusual tactic of using an NPM package name to attack PyPI users was observed. The payloads allow remote access, control of desktops and servers, and exfiltration of sensitive data. Windows payloads attempt to bypass antivirus protection. The campaign's sophistication suggests targeted adversarial activity, although attribution remains unclear.</p><p>Pulse ID: 683e1f7f063d60138cc2ccf6<br>Pulse Link: <a href="https://otx.alienvault.com/pulse/683e1f7f063d60138cc2ccf6" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">otx.alienvault.com/pulse/683e1</span><span class="invisible">f7f063d60138cc2ccf6</span></a> <br>Pulse Author: AlienVault<br>Created: 2025-06-02 22:02:39</p><p>Be advised, this data is unverified and should be considered preliminary. Always do further verification.</p><p><a href="https://social.raytec.co/tags/Colorama" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Colorama</span></a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://social.raytec.co/tags/ICS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ICS</span></a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfoSec</span></a> <a href="https://social.raytec.co/tags/Java" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Java</span></a> <a href="https://social.raytec.co/tags/JavaScript" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>JavaScript</span></a> <a href="https://social.raytec.co/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://social.raytec.co/tags/NPM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NPM</span></a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OTX</span></a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenThreatExchange</span></a> <a href="https://social.raytec.co/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> <a href="https://social.raytec.co/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> <a href="https://social.raytec.co/tags/RAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RAT</span></a> <a href="https://social.raytec.co/tags/SupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SupplyChain</span></a> <a href="https://social.raytec.co/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Windows</span></a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bot</span></a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AlienVault</span></a></p>
Pyrzout :vm:<p>Backdoors in Python and NPM Packages Target Windows and Linux – Source:hackread.com <a href="https://ciso2ciso.com/backdoors-in-python-and-npm-packages-target-windows-and-linux-sourcehackread-com/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">ciso2ciso.com/backdoors-in-pyt</span><span class="invisible">hon-and-npm-packages-target-windows-and-linux-sourcehackread-com/</span></a> <a href="https://social.skynetcloud.site/tags/1CyberSecurityNewsPost" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>1CyberSecurityNewsPost</span></a> <a href="https://social.skynetcloud.site/tags/CyberSecurityNews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurityNews</span></a> <a href="https://social.skynetcloud.site/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://social.skynetcloud.site/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberAttack</span></a> <a href="https://social.skynetcloud.site/tags/SupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SupplyChain</span></a> <a href="https://social.skynetcloud.site/tags/Hackread" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Hackread</span></a> <a href="https://social.skynetcloud.site/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://social.skynetcloud.site/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://social.skynetcloud.site/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Windows</span></a> <a href="https://social.skynetcloud.site/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> <a href="https://social.skynetcloud.site/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://social.skynetcloud.site/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> <a href="https://social.skynetcloud.site/tags/NPM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NPM</span></a></p>
Pyrzout :vm:<p>Backdoors in Python and NPM Packages Target Windows and Linux <a href="https://hackread.com/backdoors-python-npm-packages-windows-linux/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">hackread.com/backdoors-python-</span><span class="invisible">npm-packages-windows-linux/</span></a> <a href="https://social.skynetcloud.site/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersecurity</span></a> <a href="https://social.skynetcloud.site/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberAttack</span></a> <a href="https://social.skynetcloud.site/tags/SupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SupplyChain</span></a> <a href="https://social.skynetcloud.site/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Security</span></a> <a href="https://social.skynetcloud.site/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Malware</span></a> <a href="https://social.skynetcloud.site/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Windows</span></a> <a href="https://social.skynetcloud.site/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> <a href="https://social.skynetcloud.site/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Linux</span></a> <a href="https://social.skynetcloud.site/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> <a href="https://social.skynetcloud.site/tags/NPM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NPM</span></a></p>
Torbjørn Wikestad<p><span class="h-card" translate="no"><a href="https://mastodon.xyz/@brunopostle" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>brunopostle</span></a></span> I don't know about the relevance of <a href="https://mastodon.world/tags/gbXML" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>gbXML</span></a> , beside it being used by <a href="https://mastodon.world/tags/energyplus" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>energyplus</span></a> / <a href="https://mastodon.world/tags/OpenStudio" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenStudio</span></a> . From the thesis of MGVisschers, I get the impression that the format is supposed by all building energy simulation software. And I've seen there is already a well developed gbxml package on <a href="https://mastodon.world/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a> . To me, it seems obvious there should be a developed package for conversion between <a href="https://mastodon.world/tags/IFC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IFC</span></a> and gbxml.</p>
Torbjørn Wikestad<p><span class="h-card" translate="no"><a href="https://mastodon.xyz/@brunopostle" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>brunopostle</span></a></span> I thought we could start a discussion here on the development of a Python package for IFC-to-gbXML-conversion, with the aim of making it available on PyPI and Conda. By having the discussion here, we might attract the interest of other contributors. </p><p>You've already done great work on your fork of MSVisschers' original repo. For reference, I'll link to your repo here: <a href="https://github.com/brunopostle/IFC-to-gbXML-converter" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/brunopostle/IFC-to-</span><span class="invisible">gbXML-converter</span></a></p><p><a href="https://mastodon.world/tags/IFC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IFC</span></a> <a href="https://mastodon.world/tags/Conda" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Conda</span></a> <a href="https://mastodon.world/tags/gbXML" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>gbXML</span></a> <a href="https://mastodon.world/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a> <a href="https://mastodon.world/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>python</span></a></p>
Hackread.com<p>🚨 Hackers are hiding malware inside AI/ML models on PyPI, targeting <a href="https://mstdn.social/tags/AlibabaAILabs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AlibabaAILabs</span></a> users. Malicious packages dropped infostealers through infected Pickle files. </p><p>Read: <a href="https://hackread.com/malware-ai-models-pypi-targets-alibaba-ai-labs-users/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">hackread.com/malware-ai-models</span><span class="invisible">-pypi-targets-alibaba-ai-labs-users/</span></a></p><p><a href="https://mstdn.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mstdn.social/tags/Alibaba" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Alibaba</span></a> <a href="https://mstdn.social/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> <a href="https://mstdn.social/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Malware</span></a> <a href="https://mstdn.social/tags/CyberAttacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberAttacks</span></a> <a href="https://mstdn.social/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a></p>
OTX Bot<p>Malicious attack method on hosted ML models now targets PyPI</p><p>A new malicious campaign has been discovered targeting the Python Package Index (PyPI) by exploiting the Pickle file format in machine learning models. Three malicious packages posing as an Alibaba AI Labs SDK were detected, containing infostealer payloads hidden inside PyTorch models. The packages exfiltrate information about infected machines and .gitconfig file contents. This attack demonstrates the evolving threat landscape in AI and machine learning, particularly in the software supply chain. The campaign likely targeted developers in China and highlights the need for improved security measures and tools to detect malicious functionality in ML models.</p><p>Pulse ID: 68343195f3f6c6e7a2fde462<br>Pulse Link: <a href="https://otx.alienvault.com/pulse/68343195f3f6c6e7a2fde462" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">otx.alienvault.com/pulse/68343</span><span class="invisible">195f3f6c6e7a2fde462</span></a> <br>Pulse Author: AlienVault<br>Created: 2025-05-26 09:17:09</p><p>Be advised, this data is unverified and should be considered preliminary. Always do further verification.</p><p><a href="https://social.raytec.co/tags/China" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>China</span></a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfoSec</span></a> <a href="https://social.raytec.co/tags/InfoStealer" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfoStealer</span></a> <a href="https://social.raytec.co/tags/Mac" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Mac</span></a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OTX</span></a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenThreatExchange</span></a> <a href="https://social.raytec.co/tags/PyPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPI</span></a> <a href="https://social.raytec.co/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> <a href="https://social.raytec.co/tags/RAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RAT</span></a> <a href="https://social.raytec.co/tags/SupplyChain" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SupplyChain</span></a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bot</span></a> <a href="https://social.raytec.co/tags/developers" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>developers</span></a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AlienVault</span></a></p>
Gleb Ebert<p>I enjoyed writing my first blog post last weekend, so I thought I'd write another one. This one is about a <a href="https://mstdn.science/tags/bash" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bash</span></a> script that became a <a href="https://mstdn.science/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> script and is now a package. All because I was too lazy to label plates and tubes in the lab by hand. The post is mostly about the history and motivation behind the package, i.e. the stuff that does't really fit into the README</p><p><a href="https://www.gl-eb.me/blog/posts/2025-05-25_generate-labels/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">gl-eb.me/blog/posts/2025-05-25</span><span class="invisible">_generate-labels/</span></a></p><p><a href="https://mstdn.science/tags/quarto" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>quarto</span></a> <a href="https://mstdn.science/tags/foss" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>foss</span></a> <a href="https://mstdn.science/tags/Pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Pypi</span></a> <a href="https://mstdn.science/tags/uv" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>uv</span></a></p>
Steve Leach<p><a href="https://sigmoid.social/tags/Python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Python</span></a> <a href="https://sigmoid.social/tags/Wikipedia" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Wikipedia</span></a> library on <a href="https://sigmoid.social/tags/PyPi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PyPi</span></a> is currently broken. I was gonna do a crawl with it starting with "Earth" and then getting all pages linked from there and all from those, etc.</p><p>Unfortunately, "Earth" returns the page for "Death" instead. Every single time.</p><p>The next thing I tried I forget but it failed entirely. But Earth maps to Death in the library always right now.</p><p><a href="https://sigmoid.social/tags/Wikipedia" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Wikipedia</span></a>-api library works though.</p>
Open Risk<p>There are currently 636,000 <a href="https://mastodon.social/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>python</span></a> projects on <a href="https://mastodon.social/tags/pypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>pypi</span></a> </p><p>By the time you read this there will be several more, to the tune of one every few minutes</p><p><a href="https://mastodon.social/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>opensource</span></a> tools, algorithms, frameworks for <a href="https://mastodon.social/tags/datascience" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>datascience</span></a>, <a href="https://mastodon.social/tags/machinelearning" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>machinelearning</span></a>, <a href="https://mastodon.social/tags/webdev" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>webdev</span></a> and much, much more, in principle accessible to everybody</p><p>What does this mean, where will this lead?</p><p>Your guess as good as mine. But this is emphatically *not* the world we used to live-in, until recently</p><p>Remember this when you are gloomy</p><p><a href="https://pypi.org/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">pypi.org/</span><span class="invisible"></span></a></p>