That is scary. But it does require using a custom repository, so hopefully few were hit.
We use poetry, enough which allows specifying additional package repos and it looks like we’d be susceptible to the same attack, but for our internal package index. Looks like I have something to fix this week, thanks for the link!
Pytorch Nightly: https://pytorch.org/blog/compromised-nightly-dependency/
https://www.theregister.com/2023/01/04/pypi_pytorch_dependency_attack/
Funnily enough I can’t even post what it does without the Lemmy comment filter zapping me, but it tried to scrape accounts and passwords.
Was pretty scary from my perspective. I missed it by a week. PyPi is a mess, and it makes me wonder how much isn’t caught.
That is scary. But it does require using a custom repository, so hopefully few were hit.
We use poetry, enough which allows specifying additional package repos and it looks like we’d be susceptible to the same attack, but for our internal package index. Looks like I have something to fix this week, thanks for the link!