Post #1860148
2026-04-30 18:50 UTC
@davidism my favourite example is "I can run code when you run Python during/after pip install (with extra conditions), give me remote RCE CVE rated 9+ plz". 😅
Replies (1)
-
@ichard26@fosstodon.org 2026-04-30 20:00
@pradyunsg @davidism Recently we even got one that was like "hey, if the package index was compromised in this *obscure* way, because pip doesn't validate metadata consistency in this one specific area, pip now has a critical security vulnerability 💥" like... c'mon, we'd have much BIGGER problems beyond pip if PyPI was compromised/insecure