When pip install Is Not Enough: Real Threats and Practical Defenses
summary
Shows how pip install can execute code beyond downloading, describing typosquatting and dependency-confusion attacks (e.g., compromised packages and the Glasswm campaign) that add backdoors, exfiltrate data, use obfuscated install scripts and hidden dependency chains. Recommends concrete defenses: run pip-audit, Safety, OSV Scanner and Bandit; pin versions; generate SBOMs; sign packages; harden CI/CD; rotate credentials; and monitor for spikes and suspicious connections.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:54Python supply chain
- 6:26Real threats
- 8:33Attack techniques
- 11:42Chile cybersecurity laws
- 15:55Local threat indicators
- 18:24Malicious dependency detection
- 21:34Reducing risks
- 24:43Security culture
related talks
28mpip audit dozens of vulnerabilities after
26mSecure Software Supply Chains for Python
18mMalicious Needle in a Haystack – PyPi Security Pitfalls
43mHow to hack and defend (your) open source
20mMalicious Needle in a Haystack - PyPi Security Pitfalls
29mReducing the "Oops Factor": Pipelines for a Secure Python Development Lifecycle
34mSecure Python Development: Tips, Tricks, and Tools
25m"Security considerations in Python Packaging"