Update from our Security Engineers
summary
Security update lists concrete shifts: over 2,800 malware reports processed, upstream compromise is common with a transitive exploit seeing about 300,000 downloads a day and Light LLM suffering ~119,000 compromised installs before quarantine, so pin and audit dependencies now. Trusted publishing mints short lived tokens and adds provenance via GitHub Actions. Supply chain work includes a public Trail of Bits audit that is passed and governance (PEP 811) plus SBOM adoption across ~300 packages.
AI-written summary · about
chapters (10)
- 0:00Python team introduction
- 0:50Malware attacks and supply chain threats
- 3:19Lateral movement in cross-ecosystem attacks
- 5:01Trusted publishers for secure publishing
- 7:29Passing the second security audit
- 9:16AI-driven vulnerability discovery
- 12:05Strengthening Python security response
- 13:08SBOM for dependency tracking
- 14:34Security education impact
- 15:16Supporting PSF for security
related talks
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises
10mUpdate from our Security Engineers
25mWhen the supply chain hits a sour note
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target
58mAttacking through the Software Supply Chain
13mKeynote: Hacking the OSS Supply Chain
16mPerformance improvements: exposing hidden security fixes in Open Source
13mKeynote: Hacking the OSS Supply Chain