# PyPI PyPI, the Python Package Index, is a repository for software packages for the Python programming language. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Собрать прошлое: как архивировать весь трафик сборки SONiC DevFeed: [Собрать прошлое: как архивировать весь трафик сборки SONiC]() Original publisher: [Read original article]() Author: denballakh (Яндекс, Yandex Cloud & Yandex Infrastructure) Published: 2026-07-20T07:03:18Z Content type: tutorial Language: ru Sources: [Яндекс - Как мы делаем Яндекс / Статьи]() Topics: [Docker](), [Debian](), [HTTP](), [docker registry](), [GitHub](), [PyPI](), [Python]() Tags: [build](), [debian](), [docker](), [docker-registry](), [github](), [http](), [infrastructure](), [mitm](), [proxy](), [pypi](), [reproducibility](), [sonic]() ### AI overview This article explains how Yandex Infrastructure developed a caching MITM proxy for SONiC and YaSONiC builds. The proxy captures HTTP/HTTPS traffic and serves previously saved responses to improve build reproducibility when external dependencies change or disappear. ### Source excerpt Интернет -- это зависимость без зафиксированной версии. Сегодня он возвращает одно, завтра -- другое, а послезавтра -- ничего. Поэтому мы решили сохранить для сборки тот интернет, который она однажды увидела. Для этого пришлось перехватывать HTTPS, выпускать собственные сертификаты, переподписывать индексы Debian и выяснять, почему Docker отправляет "случайные" заголовки. В этой статье я расскажу, как разрабатывал кеширующую MITM-проксю, которая перехватывает весь HTTP/HTTPS-трафик и отдаёт ранее сохранённые ответы. Разберём также неочевидные технические проблемы, с которыми пришлось столкнуться. Читать далее ## Come join us at the next SQGNE Meeting! Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats - June 17, 2026 DevFeed: [Come join us at the next SQGNE Meeting! Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats - June 17, 2026]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-06-02T02:34:08Z Content type: news Language: en Sources: [T.J. Maher]() Topics: [open-source-security](), [supply-chain-security](), [Malware](), [npm](), [PyPI](), [GitHub](), [software composition analysis](), [Security]() Tags: [github](), [malware](), [npm](), [open-source](), [pypi](), [sca](), [security](), [software-supply-chain](), [sqgne](), [supply-chain](), [supply-chain-attacks]() ### AI overview The Software Quality Group of New England will host a June 17, 2026 meeting featuring Bryan Whyte of Sonatype on open-source malware and software supply chain defense. The session will cover threats targeting npm, PyPI, GitHub, and development pipelines; differences between open-source malware and traditional malware or vulnerabilities; and common tactics used in software supply chain attacks. ### Source excerpt "Open-Source Malware: Defending Your Software Supply Chain From Evolving Threats" will be the topic of the next Software Quality Group of New England (sqgne.org) meeting. Speaker: Bryan Whyte, CISSP Director, Solutions Engineering @Sonatype Date: June 17, 2026 @ 6:00 pm Join us on Zoom or in person at Burlington, MA ( Register Here ) "Bryan Whyte breaks down the latest wave of open source malware, explains how these threats diverge from traditional vulnerabilities, and shares actionable steps for organizations to defend mission-critical software. "As organizations deepen their reliance on open-source software, evolving security threats are reshaping the landscape at an unprecedented pace. "Threat actors are now increasingly targeting development pipelines and trusted ecosystems like npm to orchestrate supply chain attacks with significant downstream impact. Incidents such as the 2025 Shai-Hulud npm campaign, the XZ Utils backdoor, and the widespread compromise of over 23,000 GitHub repositories illustrate how open-source malware has quickly become a critical, top-tier threat built to evade legacy scanning and exploit trust woven into modern delivery pipelines. "--The shifting tactics of threat actors targeting npm, PyPi, GitHub, and development pipelines "--Key differences between open-source malware and traditional malware or vulnerabilities "--The most prevalent malware types and tactics driving today's software supply chain attacks "After spending 20 years in software development, Bryan started his journey into Application Security in 2015 with the AppScan tool suite for Static, Dynamic and Mobile Application Security Testing. In 2018, he expanded his Cybersecurity proficiency, earning the Certified Information Systems Security Professional (CISSP). In 2019, he was excited to join Sonatype due to the explosive growth of open-source software, which has made Software Composition Analysis (SCA) a critical aspect of Application Security". See you there! Happy Testing ## Cyber resiliency in practice: Lessons from recent supply chain attacks DevFeed: [Cyber resiliency in practice: Lessons from recent supply chain attacks]() Original publisher: [Read original article]() Published: 2026-05-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [resiliency](), [supply chain attacks](), [supply-chain-security](), [axios](), [GitHub Actions](), [litellm](), [trivy](), [npm](), [PyPI](), [Python](), [Large Language Model]() Tags: [axios](), [chainguard-libraries](), [cyber-resiliency](), [cybersecurity](), [github-actions](), [litellm](), [malware](), [npm](), [pypi](), [python](), [security](), [security-attacks](), [social-engineering](), [software-supply-chain-security](), [supply-chain-attacks](), [trivy](), [worm]() ### AI overview The article defines cyber resiliency as an integrated ability to anticipate, withstand, recover from, and adapt to attacks across the full Protect, Detect, Respond, and Recover lifecycle. It examines recent supply chain attacks involving Trivy, Axios, and LiteLLM, highlighting risks such as GitHub Actions misconfiguration, long-lived tokens, incomplete credential rotation, mutable Git tags, maintainer-account compromise, and malicious package releases. ### Source excerpt Learn how modern cyber resiliency helps organizations prevent, detect, and recover from supply chain attacks like Trivy, Axios, and LiteLLM. ## Security Week 2614: атака класса supply chain на библиотеку LiteLLM DevFeed: [Security Week 2614: атака класса supply chain на библиотеку LiteLLM]() Original publisher: [Read original article]() Author: Kaspersky\_Lab ("Лаборатория Касперского") Published: 2026-03-30T17:00:04Z Content type: news Language: ru Sources: ["Лаборатория Касперского" RU]() Topics: [litellm](), [Security](), [PyPI](), [Python]() Tags: [discord](), [kubernetes](), [litellm](), [pypi](), [python](), [security](), [slack](), [ssh](), [supply-chain](), [tag-9fe8963de219](), [terraform](), [tls]() ### AI overview The article reports a supply-chain compromise affecting LiteLLM versions 1.82.7 and 1.82.8 uploaded to PyPI. The malicious code searched victims' systems for files, credentials, secrets, and cloud infrastructure data, could contact a command server, and included Kubernetes persistence capabilities. Researchers also found similar malware in two Checkmarx extensions; the malicious versions were removed, and affected users were advised to rotate credentials and secrets. ### Source excerpt Громкой новостью прошлой недели стал взлом библиотеки LiteLLM, используемой в качестве посредника для коммуникации с большим количеством языковых моделей (сообщение от разработчиков, новость на Хабре). Через другое вредоносное приложение на Python была взломана учетная запись мейнтейнера проекта, после чего сразу две версии LiteLLM (1.82.7 и 1.82.8) с вредоносными модулями были загружены в репозиторий PyPI. Отчет с анализом вредоносного кода опубликовали эксперты "Лаборатории Касперского". В версии 1.82.7 вредоносный код был встроен в файл proxy_server.py. В версии 1.82.8 дополнительно появился .pth-файл, благодаря которому вредоносный код выполнялся при каждом запуске интерпретатора, даже если зараженная библиотека не использовалась. После запуска зараженный скрипт начинал рекурсивный обход рабочих директорий в системе жертвы. В каждой директории скрипт просматривал содержимое файлов, которое выводил в буфер stdout и сохранял в файл для последующей отправки на командный сервер злоумышленников. Далее скрипт собирал информацию о системе и также сохранял в файл. После этого он переходил к поиску конфиденциальных данных, включая следующие типы: Читать далее ## Santa's Python Pitfalls: A Java Developer's Guide to Staying Safe This Christmas DevFeed: [Santa's Python Pitfalls: A Java Developer's Guide to Staying Safe This Christmas]() Original publisher: [Read original article]() Author: Steve Poole Published: 2025-12-24T03:03:09Z Content type: tutorial Language: en Sources: [Java Advent Calendar]() Topics: [Python](), [pip](), [PyPI](), [Maven Central](), [Java](), [Maven]() Tags: [2025](), [attacks](), [dependency](), [developer](), [guide](), [install](), [internet](), [java](), [maven-central](), [mirror](), [model](), [packaging](), [pitfalls](), [pypi](), [python](), [registry](), [trust]() ### AI overview A Java-focused guide to Python package-management risks. It contrasts Maven Central with PyPI, highlighting flat package naming, trusting dependency resolution, typosquatting, dependency confusion, and unsafe installation commands. It recommends version pins, known sources, private registries, and lock files. ### Source excerpt Just like that it happened. You, a disciplined Java developer, are now installing Python. Like everything in 2025, it just arrived. One day, you were running a tidy mvn install, the next, you're learning about virtual environments and fighting an unfriendly pip install that won't explain what it just pulled from the internet. Good news: [...] The post Santa's Python Pitfalls: A Java Developer's Guide to Staying Safe This Christmas appeared first on JVM Advent. ## Google introduces OSS Rebuild for reproducible open-source package artifacts DevFeed: [Google introduces OSS Rebuild for reproducible open-source package artifacts]() Original publisher: [Read original article]() Author: Kimberly Samra (noreply@blogger.com) Published: 2025-07-21T21:34:00Z Content type: release Language: en Sources: [Google Online Security]() Topics: [open-source-security](), [Open Source](), [supply chain attacks](), [npm](), [PyPI](), [Rust]() Tags: [announce](), [none](), [npm](), [open-source](), [open-source-security](), [pypi](), [rust](), [slsa](), [supply-chain-attacks]() ### AI overview Google announced OSS Rebuild, a project that reproduces upstream package artifacts to provide build definitions, SLSA provenance, and verification tools for PyPI, npm, and Crates.io packages. ### Source excerpt Posted by Matthew Suozzo, Google Open Source Security Team (GOSST) Today we're excited to announce OSS Rebuild, a new project to strengthen trust in open source package ecosystems by reproducing upstream artifacts. As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without burden on upstream maintainers. The project comprises: Automation to derive declarative build definitions for existing PyPI (Python), npm (JS/TS), and Crates.io (Rust) packages. SLSA Provenance for thousands of packages across our supported ecosystems, meeting SLSA Build Level 3 requirements with no publisher intervention. Build observability and verification tools that security teams can integrate into their existing vulnerability management workflows. Infrastructure definitions to allow organizations to easily run their own instances of OSS Rebuild to rebuild, generate, sign, and distribute provenance. Challenges Open source software has become the foundation of our digital world. From critical infrastructure to everyday applications, OSS components now account for 77% of modern applications. With an estimated value exceeding $12 trillion, open source software has never been more integral to the global economy. Yet this very ubiquity makes open source an attractive target: Recent high-profile supply chain attacks have demonstrated sophisticated methods for compromising widely-used packages. Each incident erodes trust in open ecosystems, creating hesitation among both contributors and consumers. The security community has responded with initiatives like OpenSSF Scorecard, pypi's Trusted Publishers, and npm's native SLSA support. However, there is no panacea: Each effort targets a certain aspect of the problem, often making tradeoffs like shifting work onto publishers and maintainers. Our Aim Our aim with OSS Rebuild is to empower the security community to deeply understand and control their supply chains by makin ## Guarding the Python Ecosystem Against the Growing Number of Severe Malware Attacks DevFeed: [Guarding the Python Ecosystem Against the Growing Number of Severe Malware Attacks]() Original publisher: [Read original article]() Published: 2025-05-21T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries for python](), [chainguard libraries](), [Malware](), [PyPI](), [open-source-security](), [supply-chain-security]() Tags: [chainguard-libraries](), [chainguard-libraries-for-python](), [libraries](), [malware](), [open-source-software](), [packages](), [pypi](), [python](), [security](), [software-supply-chain](), [software-supply-chain-security]() ### AI overview The article explains that growing reliance on Python packages from PyPI increases exposure to malware risks. It presents Chainguard Libraries for Python as a more secure package index whose libraries and dependency trees are built from source in hardened infrastructure. ### Source excerpt Chainguard developed Chainguard Libraries for Python to help guard the Python ecosystem against malware attacks. Discover why we did it and how it works. ## Application Security Roundup - September DevFeed: [Application Security Roundup - September]() Original publisher: [Read original article]() Author: Adam Published: 2022-09-30T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [Application Security](), [Security](), [DevSecOps](), [supply-chain-security](), [pip](), [PyPI](), [Python](), [PyTorch](), [Cryptography]() Tags: [application-security](), [appsec](), [cryptography](), [devsecops](), [pypi](), [python](), [pytorch](), [security](), [supply-chain-security]() ### AI overview A monthly application security roundup covering access-control failures, STRIDE, DevSecOps, attack trees, software supply-chain attacks, customer-service risks, PyPI package installation behavior, PyTorch loading behavior, and cryptography. ### Source excerpt Interesting appsec posts: machine learning, performance, and C4 ## PDFx update and new version release (v1.4.1) DevFeed: [PDFx update and new version release (v1.4.1)]() Original publisher: [Read original article]() Author: Chris Hager Published: 2021-04-12T00:00:00Z Content type: release Language: en Sources: [Chris Hager]() Topics: [pdf](), [Python](), [Command-line interface](), [PyPI](), [Pytest](), [GitHub]() Tags: [cli](), [code](), [contributors](), [coverage](), [github](), [markdown](), [pdf](), [pdfx](), [pypi](), [python](), [release](), [tests](), [update](), [version]() ### AI overview PDFx, a Python tool and library for extracting text, links, references, and metadata from PDF files and URLs, was updated and released as version 1.4.1. The update includes broader Python compatibility, a switch to pdfminer.six, linting and static checks, tests, formatting, GitHub workflows, improved PDF URL detection, and inclusion of tests in the PyPI tarball. ### Source excerpt PDFx is a tool to extract text, links, references and metadata from PDF files and URLs. Thanks to several contributors the project received a thorough update and was brought into 2021. The new release of today is PDFx v1.4.1 🎉 PDFx works like this: ## A new version of logzero is released (v1.6) 🎉 DevFeed: [A new version of logzero is released (v1.6) 🎉]() Original publisher: [Read original article]() Author: Chris Hager Published: 2020-10-30T00:00:00Z Content type: release Language: en Sources: [Chris Hager]() Topics: [Logging](), [Library](), [Python](), [JSON](), [PyPI](), [GitHub Actions](), [Markdown](), [Travis CI]() Tags: [github-actions](), [json](), [library](), [logging](), [markdown](), [pypi](), [python](), [travis-ci](), [v1](), [version]() ### AI overview This release article announces logzero v1.6, a Python logging library update. It describes JSON formatting, customizable colors, root logger creation, separate file and stream log levels, Markdown-based project documentation, and migration from Travis CI to GitHub Actions for testing and PyPI deployment. ### Source excerpt logzero is a simple and effective logging library for Python, with colored stream output, logfile, syslog, JSON formatting and much more: https://github.com/metachris/logzero After a really busy period with my second 🐣, I start to find a little bit of time here and there for fun projects. Recently I've enjoyed a few evenings maintaining logzero, culminating in a small release today: logzero v1.6 🎉 logzero v1.6 has several improvements: JSON formatting (with integrated python-json-logger) Easily change colors to custom color codes Allow creating of root loggers Allow file logging with lower loglevel than stream Project readme and history was converted to markdown and displays nicely on PyPI Deprecation of Travis CI Running tests with GitHub Actions, with Python versions up to 3. ## Getting Started with Pipenv DevFeed: [Getting Started with Pipenv]() Original publisher: [Read original article]() Author: masnun Published: 2017-11-25T23:09:32Z Content type: tutorial Language: en Sources: [Abu Ashraf Masnun]() Topics: [Python](), [pip](), [Package manager](), [PyPI](), [Flask](), [PyCharm](), [REST API](), [Windows]() Tags: [dependencies](), [environment-management](), [getting-started](), [install](), [packaging](), [pycharm](), [pypi](), [python](), [python-packages](), [rest-api](), [windows]() ### AI overview A tutorial introducing Pipenv for Python development. It explains how Pipenv combines package installation with isolated virtual environments, records dependencies in a Pipfile, creates a lock file for deterministic builds, and supports installing packages, running applications, activating environments, and managing dependencies. ### Source excerpt If you're a Python developer, you probably know about pip and the different environment management solutions like virtualenv or venv. The pip tool is currently the standard way to install a Python package. Virtualenv has been a popular way of isolating Python environments for a long time. Pipenv combines the very best of these tools [...] The post Getting Started with Pipenv appeared first on Abu Ashraf Masnun. ## Python Unit Testing with Mocks: Patching and Namespaces DevFeed: [Python Unit Testing with Mocks: Patching and Namespaces]() Original publisher: [Read original article]() Author: Anjana Sofia Vakil (contact@anjana.dev) Published: 2016-06-16T00:00:00Z Content type: tutorial Language: en Sources: [Mozilla Automation]() Topics: [Mocking](), [Python](), [Testing](), [Library](), [PyPI](), [pip]() Tags: [install](), [library](), [mocking](), [patches](), [pypi](), [python](), [testing](), [unit-tests]() ### AI overview A tutorial on using Python mocks in unit tests to isolate specific behavior, inspect method calls, simulate return values, and patch objects in the correct module namespace. ### Source excerpt This post brought to you from Mozilla's London All Hands meeting - cheers! When writing Python unit tests, sometimes you want to just test one specific aspect of a piece of code that does multiple things. For example, maybe you're wondering: Does object X get created here? Does method X get called here? Assuming method X returns Y, does the right thing happen after that? Finding the answers to such questions is super simple if you use mock: a library which "allows you to replace parts of your system under test with mock objects and make assertions about how they have been used." Since Python 3.3 it's available simply as unittest.mock, but if you're using an earlier Python you can get it from PyPI with pip install mock. So, what are mocks? How do you use them? Well, in short I could tell you that a Mock is a sort of magical object that's intended to be a doppelgänger for some object in your code that you want to test. Mocks have special attributes and methods you can use to find out how your test is using the object you're mocking. For example, you can use Mock.called and .call_count to find out if and how many times a method has been called. You can also manipulate Mocks to simulate functionality that you're not directly testing, but is necessary for the code you're testing. For example, you can set Mock.return_value to pretend that an function gave you some particular output, and make sure that the right thing happens in your program. But honestly, I don't think I could give a better or more succinct overview of mocks than the Quick Guide, so for a real intro you should go read that. While you're doing that, I'm going to watch this fantastic Michael Jackson video: Oh you're back? Hi! So, now that you have a basic idea of what makes Mocks super cool, let me share with you some of the tips/tips/trials/tribulations I discovered when starting to use them. Patches and namespaces tl;dr: Learn where to patch if you don't want to be sad! When you import a helper module int ## Make your open-source project accessible DevFeed: [Make your open-source project accessible]() Original publisher: [Read original article]() Published: 2015-09-21T00:00:00Z Content type: tutorial Language: en Sources: [Radek Pazdera]() Topics: [Open Source](), [Accessibility](), [Software](), [Linux](), [Homebrew](), [pacman](), [PyPI](), [npm](), [Ruby](), [rubygems]() Tags: [accessible](), [developers](), [homebrew](), [install](), [linux](), [npm](), [onboarding](), [open-source](), [packages](), [pacman](), [pypi](), [rubygems]() ### AI overview This article explains how open-source projects can improve contributor and user onboarding by making software easier to install. It recommends distribution-level packages such as Linux packages and Homebrew packages, along with language-level packages such as PyPI, Rubygems, and npm. ### Source excerpt I build software products and write on the Internet. ## mozdownload 1.18 released DevFeed: [mozdownload 1.18 released]() Original publisher: [Read original article]() Author: Admin Published: 2015-09-14T15:32:41Z Content type: release Language: en Sources: [Mozilla Automation]() Topics: [PyPI](), [API](), [Code](), [Script](), [Command-line interface]() Tags: [api](), [automation](), [code](), [command-line](), [firefox](), [mozdownload](), [mozilla](), [pypi](), [qa](), [release](), [script](), [software]() ### AI overview mozdownload 1.18 was released to PyPI with a new API that makes it easier to use mozdownload from scripts. A factory scraper selects the appropriate scraper based on the provided options, and the API can provide remote URLs and local filenames. ### Source excerpt Today we have released mozdownload 1.18 to PyPI. The reason why I think it's worth a blog post is that with this version we finally added support for a sane API. With it available using the mozdownload code in your own script is getting much easier. So there is no need to instantiate a specific scraper anymore but a factory scraper is doing all the work depending on the options it gets. Here some examples: from mozdownload import FactoryScraper scraper = FactoryScraper('release', version='40.0.3', locale='de') scraper.download() from mozdownload import FactoryScraper scraperContinue readingmozdownload 1.18 released ## Installing Python Packages DevFeed: [Installing Python Packages]() Original publisher: [Read original article]() Author: Map Published: 2011-11-01T20:55:56Z Content type: tutorial Language: en Sources: [Craig Kerstiens]() Topics: [Python](), [pip](), [PyPI](), [Django]() Tags: [install](), [pypi](), [python](), [python-packages](), [requirements](), [version]() ### AI overview A tutorial on installing Python packages with pip, using a virtualenv environment, and recording installed package versions for sharing through a requirements list. It explains that packages are hosted on PyPI and demonstrates creating, activating, and deactivating an isolated project environment. ### Source excerpt Now that you have you system and project environment all setup you probably want to start developing. But you likely don't want to start writing an entire project fully from scratch, as you dive in you'll quickly realize theres many tools helping you build projects and sites faster. For example making a request to a website there's Requests, for handling processing images there's Python Imaging Library, or for a full framework to help you in building a site there's Django. With all of these there's one simple and common way to install them. But first a little more on how it all works. All major Python packages are hosted on PyPi (Pronounced Pi-P or Cheeseshop). When you use a common python installer it will: Search for the package you specify If you specify a version will use it, otherwise will use the latest Will download the source for that package Install it into your Python environment Now for actually installing... Lets get started with installing the three packages below. At this point you should at least have a fresh Python environment, however you don't have an immediate way to install packages. The defacto Python package installer is pip. Earlier we setup virtualenv to help isolate our python packages we were working with. First lets go ahead and create a folder for our project then setup a new environment for the project we'll work on: $ mkdir myapp $ cd myapp $ virtualenv --no-site-packages venv If we list the contents of the directory you'll now see a folder venv. Within this folder you'll find all the parts of the environment that virtualenv just created: $ ls venv $ ls venv bin include lib Now you've got a sandboxed environment that exists but you haven't loaded it. You can now activate and deactivate this any time you like. Once you do this it customizes your path to use the packages you've installed for this environment. To load your environment when in the myapp directory: $ source venv/bin/activate To deactivate this simple: $ deactivate Now that we'