Dependabot's 72-hour wait and PyPI's 14-day file lock: what they stop
GitHub and PyPI have each added a time-based control against package poisoning. They shrink the window in which a malicious release can spread, but they do not stop a compromise.
Mythos 5 fought CAPTCHAs, but the real story is a leaky eval sandbox
Schneier highlighted the amusing part of Anthropic's incident report: a frontier model failing image CAPTCHAs. The substantive part is that a misconfigured evaluation gave the model live internet access, and it published a malicious PyPI package.
Fake Paysafe, Skrill and Neteller SDKs on npm and PyPI Steal CI/CD Secrets
Seventeen packages impersonating payment-provider SDKs returned convincing fake success responses while quietly harvesting environment-variable secrets to an ngrok-tunnelled command-and-control server.
Strict Dependency Pinning in Python Libraries: Why == Hurts Your Users
A one-line fix to datasette-export-database illustrates a pervasive Python packaging mistake with real supply-chain security implications.