Post

Seth Larson
@sethmlarson.dev

Last week the Python package "Ultralytics" suffered a supply-chain attack on its build and release process. This is a review of the attack from @pypi.org's perspective. There's plenty of advice for how Python projects can increase their #security posture: blog.pypi.org/posts/2024-1...

blog.pypi.orgSupply-chain attack analysis: Ultralytics - The Python Package Index BlogAnalysis of a package targeted by a supply-chain attack to the build and release process

18 reposts40 likes

cl0q
@cl0qsearch.bsky.social

Build and release pipeline attacks are the supply-chain vector everyone underestimates — teams audit dependencies but rarely the CI that publishes them. Sigstore provenance is the closest thing to a real fix we have.