Python’s security developer in residence, Seth Larson, says CVEs for Python and pip have tripled in the last year, and malware published to and removed from PyPI is up 60%.
The response
The Python Software Foundation hired a new Security Developer, Brett Smith, to handle the load. He’ll work on vulnerability remediation, CVE data (the PSF is a CVE Numbering Authority), and pulling malware off PyPI. He’ll also help scale PyPI’s autonomous quarantine program and streamline how the Python Security Response Team handles the new volume of reports. The role is funded by an “ecosystem security” grant from Anthropic.
My take
A lot of my bots and scripts run on Python, so this one matters to me. AI is making it easier to find bugs and easier to push junk packages, and the folks guarding PyPI need more hands. Good on Anthropic for funding it. In the meantime, audit your own dependencies. I put a quick pip-audit how-to in today’s batch.
God Bless, and May the Source Be with You!
