PyPi блокирует добавление модулей из России?

Это скорее вопрос, чем констатация факта. Последний раз загружал twine 'ом обновление своего модуля 11 июня. И последние дня 4-5 безуспешно пытался опубликовать еще одну библиотеку. Я уже "напряг" ChatGPT, проверил все - токен "для всех проектов", .whl и tar.gz маленькие и не битые, загружается что то одно до 100% и висит. Пробовал по одному - такая же картина. Пробовал с помощью curl - тоже самое:

https://habr.com/ru/articles/919422/

#pyton #pypi

#PyPI に潜むChimera Sandbox偽装マルウェア JFrogが警鐘 - イノベトピア - innovaTopia

マルウェアがコマンド＆コントロールサーバーと通信するためのドメイン名を自動生成するアルゴリズム。 Jamfレシート. Jamf ProなどのmacOS管理 ...
https://innovatopia.jp/cyber-security/cyber-security-news/57807/

PyPI Malware Exploits Instagram Growth Tools to Harvest Credentials

Pulse ID: 68496f698c9d93ca338f0790
Pulse Link: https://otx.alienvault.com/pulse/68496f698c9d93ca338f0790
Pulse Author: cryptocti
Created: 2025-06-11 11:58:33

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #Instagram #Malware #OTX #OpenThreatExchange #PyPI #bot #cryptocti

No i mamy kolejny powód, żeby nie używać #PythonPoetry. Właśnie wynaleźli na nowo "reproducible build", i wyszło jak zwykle. Całkiem przeoczyli cały sens tego pomysłu, i zaczęli wymuszać znaczniki czasu na plikach w archiwach źródłowych. A do tego, jak SOURCE_DATE_EPOCH nie jest ustawione, to zamiast wyłączać tę funkcję, wymuszają znacznik zerowy.

Tak więc wszystkie archiwa sdist tworzone przez Poetry i wrzucane na #PyPI dziś mają daty z roku 1970, co powoduje przypadkowe problemy. A najbardziej absurdalne w tym jest to, że ZIP nie obsługuje takich dat, więc kiedy tworzą archiwa binarne wheel, to nadpisuję tę datę inną przypadkową datą 🤦.

https://github.com/python-poetry/poetry/issues/10083

New reason not to use #PythonPoetry just dropped: they reinvented "reproducible builds", poorly. The problem is, they missed the purpose of reproducible builds entirely and they use it for source distributions too, and when you don't use SOURCE_DATE_EPOCH, they force all files to epoch (as in timestamp 0) instead of leaving them alone.

Like, all source distributions created by Poetry and uploaded to #PyPI now have 1970 timestamps that, simply speaking, break stuff. The most absurd thing is that ZIP can't handle that timestamp, so they override it and use another date for wheels 🤦.

https://github.com/python-poetry/poetry/issues/10083

#Gentoo #PEP517

Fake Solana Tool on PyPI Used to Steal Source Code

Pulse ID: 6840208305b1b70ff9ee75fa
Pulse Link: https://otx.alienvault.com/pulse/6840208305b1b70ff9ee75fa
Pulse Author: cryptocti
Created: 2025-06-04 10:31:31

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #InfoSec #OTX #OpenThreatExchange #PyPI #RCE #bot #cryptocti

PyPI Supply Chain Attack Uncovered: Colorama and Colorizr Name Confusion

A malicious package campaign targeting Python and NPM users on Windows and Linux has been discovered. The attack uses typo-squatting and name-confusion tactics against the popular colorama Python package and the similar colorizr JavaScript package. Multiple packages with risky payloads were uploaded to PyPI, using names similar to legitimate packages in both PyPI and NPM. The unusual tactic of using an NPM package name to attack PyPI users was observed. The payloads allow remote access, control of desktops and servers, and exfiltration of sensitive data. Windows payloads attempt to bypass antivirus protection. The campaign's sophistication suggests targeted adversarial activity, although attribution remains unclear.

Pulse ID: 683e1f7f063d60138cc2ccf6
Pulse Link: https://otx.alienvault.com/pulse/683e1f7f063d60138cc2ccf6
Pulse Author: AlienVault
Created: 2025-06-02 22:02:39

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Colorama #CyberSecurity #ICS #InfoSec #Java #JavaScript #Linux #NPM #OTX #OpenThreatExchange #PyPI #Python #RAT #SupplyChain #Windows #bot #AlienVault