The PSF's PyPI Safety and Security Engineer, @miketheman, is giving a keynote at OpenSSF Community Day this Thursday! "Anatomy of a Phishing Campaign" is a deep dive into the 2025 PyPI phishing attack, how it worked, and what stopped it.

Thu May 21 @ 9:20am CDT 👉 https://openssfcdna2026.sched.com/event/2I44z

#Python #PyPI #SupplyChain #Security
https://openssfcdna2026.sched.com/event/2I44z

PyPI packages are increasing rapidly

PyPI에서 주간 신규 패키지 버전 수가 최근 몇 달간 30% 이상 급증하며, AI 관련 패키지 출시에 크게 기인하고 있습니다. 이로 인해 PyPI 유지보수자들의 부담이 커지고 있으며, 악성 코드 탐지 도구인 hexora는 eval, exec, subprocess를 남용하는 패키지들이 많아 오탐이 증가하는 문제를 지적합니다. 일부 패키지는 하루에 수백 번씩 반복 출판하는 비정상적 행태도 관찰되어 생태계 안정성과 보안에 위협이 되고 있습니다. 이러한 추세는 공급망 공격 대응과 생태계 관리에 실질적 어려움을 초래할 전망입니다.

https://rushter.com/blog/pypi-packages/

#pypi #python #security #supplychain #opensource

> 120 malicious packages have been pulled from RubyGems

https://thehackernews.com/2026/05/rubygems-suspends-new-signups-after.html

For those counting: #npm, #PyPI, #RubyGems, #cargo #NuGet, #packagist and #Maven so far…

Now that the keynote is over, here are the open spaces that you can check out after the security update and the first talks after lunch. The job fair and poster sessions are also happening and I would recommend checking those out if you're interested.

Starting at 10:00 AM:

Room 102A: #Conda x #PyPI: Building Bridges That Actually Hold
Room 102B: Scroll Lock Zine
Room 102C: The Python Developers Survey: What Would YOU Ask?
Room 202C: Financial Data with Python

#PyConUS #PyConUSOpenSpaces

The #PyConUS #Security Track fires back up after lunch! See you at 1:45PM in Room 103ABC where Python core developer Emma Smith (@emmatyping) will be talking about “Rust and CPython”.

Don't miss it!! 🦀🐍

https://us.pycon.org/2026/schedule/presentation/1/

#rust #python #pyconus2026 #supplychain #memorysafety #pypi

It is still got a way to go but here is a tool for making the missing #pypi user profile.

But Matt, where do you put the signature or rel=me? In a package!

Pypi is pretty meager for profile info, but you can publish a #python package with a whole website in it.

https://pypi.org/project/pypi-profile/0.1.0/