Python Software Foundation on Mythryl: “Archive formats like ZIP and tar can be abused to undermine the…”

Archive formats like ZIP and tar can be abused to undermine the integrity of Python package users 📦 Learn how PSF Developer-in-Residence Seth Larson is strengthening Python's security with the #Python community in the new white paper "Slippery ZIPs and Sticky tar-pits" with Alpha-Omega:

pyfound.blogspot.comImproving security and integrity of Python package archivesSecurity and integrity of the Python packaging ecosystem is critical, and the smallest unit of a packaging ecosystem is a "package". Python packages use existing archive formats like ZIP and tar to distribute Python projects to their users. Archives seem simple on the surface, but many ZIP and tar features can be abused to confuse implementations into seeing different contents of the same archive.

30/10/25, 3:12 pm7 reposts31 likes

Post