This is an example PyPI (Python Package Index) package set up with automated tests and package publishing workflow using GitHub Actions CI/CD. It is made primarily for GitHub + VS Code (Windows / Mac ...
Source distributions (sdist) can execute arbitrary code during installation via setup.py, making them a common attack vector for supply chain attacks. Unlike pre-built wheels, source distributions ...
On March 24, 2026, developers building AI applications with LiteLLM — a Python package with 95 million monthly downloads — ...
Dependency confusion is a supply chain issue that affects how package managers choose where to download a dependency from. If your build or developer tooling can see both a private package registry ...
GitHub’s Dependabot waits three days before opening pull requests, and PyPI rejects file uploads to releases older than 14 ...
GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub ...
The Python Software Foundation has warned victims of a new wave of phishing attacks using a fake Python Package Index (PyPI) website to reset credentials. Accessible at pypi.org, PyPI is the default ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results