Choosing Wisely - How to Pick the Right Third Party Packages for your Project
summary
Example-driven checklist: a mistyped dependency becomes a real compromise — on 2023-02-09 about 400+ malicious packages appear on PyPI and a misspelt matplotlib typo attack installs a clipboard-stealing extension and drains crypto. Concrete signals to check are commit and release cadence, download counts, license file (GPL vs MIT/Apache), test suite and issue response times, and whether Dependabot/Safety/Snyk or a private repository is used. If no safe option exists, pin, vendor, audit or commission a penetration test and budget maintenance.
AI-written summary · about
chapters (14)
- 0:00Third-party package risks
- 2:55Why packages are risky
- 3:57Project risk profile
- 7:01Updating risk profiles
- 7:22Architectural fit of packages
- 10:32Package licensing risks
- 14:35Package security risks
- 19:06Package maintenance risks
- 21:10Package quality risks
- 22:36Snyk Advisor for evaluation
- 23:40Alternatives to risky packages
- 25:03Mitigating package risks
- 27:51Safer package selection
- 28:36Q&A on licensing
related talks
25m"Security considerations in Python Packaging"
43mHow to hack and defend (your) open source
10mLightning Talk: Scoring Dependencies to Detect “Weak Links” in your Open-source So...
18mMalicious Needle in a Haystack – PyPi Security Pitfalls
20mMalicious Needle in a Haystack - PyPi Security Pitfalls
26mSecure Software Supply Chains for Python
28mWhen pip install Is Not Enough: Real Threats and Practical Defenses
20mHow I Learned to Stop Worrying and Love Public Packages