#pypi articles | Hashnode

One key nobody revoked, four months later a malicious PyPI package

Summary On October 21, 2026, LiteLLM's release pipeline published a malicious litellm==1.107.0 to PyPI, Docker Hub and GHCR. The package was signed and shipped through the official process, so every s

14 min readblog.fiscybersec.com

AngusKitOct 13

How to use a private PyPI index: from install to twine upload and pip install

After self-hosting, wire PyPI: create HOSTED/PROXY/GROUP, configure .pypirc and pip.conf, smoke-test with a minimal package, and fix 401 and No matching distribution.

5 min readanguskit.hashnode.dev

Nitesh Kumar TuduSep 11

When Your AI Coding Agent Goes Rogue

As a developer it's on us to handle the proper guardrails to keep ai within it. And handle it with proper instructions.

6 min readblog.thecodingant.in

Sriram SriramAug 16

I Built Argus Header: A Python CLI Tool for HTTP Security Header Analysis

Learn how I built Argus Header, an open-source Python CLI that analyzes HTTP security headers, detects misconfigurations, information leakage, CORS issues, and generates security reports.

20 min readargus-header.hashnode.dev

Lưu Tuấn AnhJun 16

Shai-Hulud Returns: When Just One pip install Command Can Steal All Your Secrets

Overview of the campaign June 2026 marked a concerning escalation of the malware supply chain campaign named Shai-Hulud, as new variants expanded from the Node.js ecosystem to Python, directly affecti

11 min readblog.fiscybersec.com

Oliver ZehentleitnerMay 5

Binance Fixed the IP Whitelist Gap. The Disclosure Process Is Still Broken.

I reported the listenKey issue in December 2024. Thirteen days of recent supply-chain findings pushed me to re-test it — and the vulnerability now appears closed after being rejected as “Social Engineering.”

11 min readblog.technopathy.club

1

Lưu Tuấn AnhMay 6

TeamPCP and the supply chain attack campaign spread themselves through the open source ecosystem

Overview From April 21 to 22, 2026, the supply chain attack campaign attributed to the TeamPCP group (or UNC6780) unexpectedly reactivated after a 26-day hiatus. This outbreak didn't stop at a single

8 min readblog.fiscybersec.com

Oliver ZehentleitnerMay 5

The PyPI Package Was Clean. That Was the Problem.

A near-identical clone of my Binance WebSocket library had no payload — but it spoofed identity, shadowed the import path, linked to a 404 repo, and came from the same account as pybotnet.

13 min readblog.technopathy.club

Sai Sandeep KantareddyApr 13

Building MARE v2: From a PDF Retrieval Idea to an Evidence-First Open-Source Library

A little while ago, I wrote about an idea I kept coming back to: Most “chat with your PDF” systems optimize for fluent answers, but not for evidence. That felt backwards. In real document workflows, p

12 min readtokenbytoken.hashnode.dev

GitHubOpenSourceNov 16, 2025

Stop Fighting PDF Forms: Automate Everything with PyPDFForm

📝 Quick Summary: PyPDFForm is a Python library designed for processing PDF forms. It provides functionalities to inspect form data requirements, fill forms using Python dictionaries, create form fields, extract pages, and merge multiple PDFs. 🔑 Key...

3 min readgithub-open-source.hashnode.dev

Search Hashnode

Trending tags this week