krnavy

After 2FA, the previous PyPI buzzword that was forced on everyone, JFrog discovered a key leak that compromised everything:

https://news.ycombinator.com/item?id=40941809

JFrog also discovered multiple malicious package exploits later.

Now we get a Github centric new buzzword that could be replaced by trusted SHA256 sums. Python is also big on business speak like SBOM. The above key leak of course occurred after all these new security "experts" manifested themselves out of nowhere.

The procedure remains the same. Download a package from the original creators, audit it, use a local repo and block PyPI.