SSH keys stolen by stream of malicious PyPI and npm packages
A stream of malicious npm and PyPi packages have been found stealing a wide range of sensitive data from software developers on the platforms. The campaign started on September 12, 2023, and was first discovered by Sonatype, whose analysts unearthed 14 malicious packages on npm. Phylum reports that after a brief operational hiatus on September 16 and 17, the attack has resumed and expanded to the
Modular: Mojo🔥 - It’s finally here!
Since our launch of the Mojo programming language on May 2nd, more than 120K+ developers have signed up to use the Mojo Playground and 19K+ developers actively discuss Mojo on Discord and GitHub. Today, we’re excited to announce the next big step in Mojo’s evolution: Mojo is now available for local download – beginning with Linux systems, and adding Mac and Windows in coming releases. While the Mo
Announcing Astral, the company behind Ruff
TL;DR: I’ve started a company, Astral, to continue building high-performance developer tools for the Python ecosystem — to keep building Ruff, and to build more Ruff-like things. We’ve raised $4m in seed funding led by Accel, with participation from Caffeinated Capital, Guillermo Rauch (Vercel), Solomon Hykes (Docker), David Cramer (Sentry), and others. I built Ruff to test a theory: that Python t
March 20 ChatGPT outage: Here’s what happened
An update on our findings, the actions we’ve taken, and technical details of the bug. We took ChatGPT offline earlier this week due to a bug in an open-source library which allowed some users to see titles from another active user’s chat history. It’s also possible that the first message of a newly-created conversation was visible in someone else’s chat history if both users were active around the
Investigating a backdoored PyPi package targeting FastAPI applications | Datadog Security Labs
Introduction FastAPI is a highly popular Python web framework. On November 23rd, 2022, the Datadog Security Labs team identified a third-party utility Python package on PyPI related to FastAPI, fastapi-toolkit, that has been backdoored by a malicious actor. The attacker inserted a backdoor in the package, adding a FastAPI route allowing a remote attacker to execute arbitrary python code and SQL qu
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Introducing Socket Firewall: Free, Proactive Protection for Your Software Supply Chain
Settings | uv
https://secure.software/
Configuration of a minimum package age required before a PR is created · Issue #3651 · dependabot/dependabot-core
GitHub - astral-sh/rye: a Hassle-Free Python Experience
Japan Blames North Korea for PyPI Supply Chain Cyberattack
CodSpeed: Optimize Performance, Eliminate Regressions
Amazon.co.jp: 実装で学ぶフルスタックWeb開発 エンジニアの視野と知識を広げる「一気通貫」型ハンズオン: 株式会社オープントーン, 佐藤大輔, 伊東直喜, 上野啓二: 本
CVE-2022-0329 and the problems with automated vulnerability management
Getting Started with Natural Language Processing
Security concerns · Issue #1026 · langchain-ai/langchain
GitHub - langchain-ai/langchain: 🦜🔗 Build context-aware reasoning applications 🦜🔗
GitHub - Layout-Parser/layout-parser: A Unified Toolkit for Deep Learning Based Document Image Analysis
GitHub - exaloop/codon: A high-performance, zero-overhead, extensible Python compiler with built-in NumPy support
GitHub - huggingface/tokenizers: 💥 Fast State-of-the-Art Tokenizers optimized for Research and Production
