--- title: "#pypi articles | Hashnode" description: "Explore 44 articles tagged #pypi on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/pypi" --- Tag # #pypi 44 posts · 2 followers [Vũ Nhật Lâm](https://hashnode.com/@kami61) · [Nov 5](https://hashnode.com/posts/litellm-1107-supply-chain-attack-chain-en/6aec002a8fddbd4c58bf3572) ### [One key nobody revoked, four months later a malicious PyPI package](https://blog.fiscybersec.com/litellm-1107-supply-chain-attack-chain-en?utm_source=hashnode&utm_medium=feed) Summary On October 21, 2026, LiteLLM's release pipeline published a malicious litellm==1.107.0 to PyPI, Docker Hub and GHCR. The package was signed and shipped through the official process, so every s 14 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/litellm-1107-supply-chain-attack-chain-en?utm_source=hashnode&utm_medium=feed) [AngusKit](https://hashnode.com/@anguskit) · [Oct 13](https://hashnode.com/posts/how-to-use-a-private-pypi-index-from-install-to-twine-upload-and-pip-install/6acdc9a4b6ee3a621ef92189) ### [How to use a private PyPI index: from install to twine upload and pip install](https://anguskit.hashnode.dev/how-to-use-a-private-pypi-index-from-install-to-twine-upload-and-pip-install?utm_source=hashnode&utm_medium=feed) After self-hosting, wire PyPI: create HOSTED/PROXY/GROUP, configure .pypirc and pip.conf, smoke-test with a minimal package, and fix 401 and No matching distribution. 5 min read · [anguskit.hashnode.dev](https://anguskit.hashnode.dev/how-to-use-a-private-pypi-index-from-install-to-twine-upload-and-pip-install?utm_source=hashnode&utm_medium=feed) [Nitesh Kumar Tudu](https://hashnode.com/@nitesh000) · [Sep 11](https://hashnode.com/posts/when-your-ai-coding-agent-goes-rogue/6aa3831a8ba053d233a4c9e1) ### [When Your AI Coding Agent Goes Rogue](https://blog.thecodingant.in/when-your-ai-coding-agent-goes-rogue?utm_source=hashnode&utm_medium=feed) As a developer it's on us to handle the proper guardrails to keep ai within it. And handle it with proper instructions. 6 min read · [blog.thecodingant.in](https://blog.thecodingant.in/when-your-ai-coding-agent-goes-rogue?utm_source=hashnode&utm_medium=feed) [Sriram Sriram](https://hashnode.com/@heyshreee) · [Aug 16](https://hashnode.com/posts/i-built-argus-header-a-python-cli-tool-for-http-security-header-analysis/6a818db8aa3d20cf90577b16) ### [I Built Argus Header: A Python CLI Tool for HTTP Security Header Analysis](https://argus-header.hashnode.dev/i-built-argus-header-a-python-cli-tool-for-http-security-header-analysis?utm_source=hashnode&utm_medium=feed) Learn how I built Argus Header, an open-source Python CLI that analyzes HTTP security headers, detects misconfigurations, information leakage, CORS issues, and generates security reports. 20 min read · [argus-header.hashnode.dev](https://argus-header.hashnode.dev/i-built-argus-header-a-python-cli-tool-for-http-security-header-analysis?utm_source=hashnode&utm_medium=feed) [Lưu Tuấn Anh](https://hashnode.com/@anhlt120) · [Jun 16](https://hashnode.com/posts/shai-hulud-returns-when-just-one-pip-install-command-can-steal-all-your-secrets/6a30f56df17ae84218da2e14) ### [Shai-Hulud Returns: When Just One pip install Command Can Steal All Your Secrets](https://blog.fiscybersec.com/shai-hulud-returns-when-just-one-pip-install-command-can-steal-all-your-secrets?utm_source=hashnode&utm_medium=feed) Overview of the campaign June 2026 marked a concerning escalation of the malware supply chain campaign named Shai-Hulud, as new variants expanded from the Node.js ecosystem to Python, directly affecti 11 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/shai-hulud-returns-when-just-one-pip-install-command-can-steal-all-your-secrets?utm_source=hashnode&utm_medium=feed) [Oliver Zehentleitner](https://hashnode.com/@oliver-zehentleitner) · [May 5](https://hashnode.com/posts/binance-fixed-the-ip-whitelist-gap-the-disclosure-process-is-still-broken/69fa20ffa386d7f121b54e29) ### [Binance Fixed the IP Whitelist Gap. The Disclosure Process Is Still Broken.](https://blog.technopathy.club/binance-fixed-the-ip-whitelist-gap-the-disclosure-process-is-still-broken?utm_source=hashnode&utm_medium=feed) I reported the listenKey issue in December 2024. Thirteen days of recent supply-chain findings pushed me to re-test it — and the vulnerability now appears closed after being rejected as “Social Engineering.” 11 min read · [blog.technopathy.club](https://blog.technopathy.club/binance-fixed-the-ip-whitelist-gap-the-disclosure-process-is-still-broken?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/binance-fixed-the-ip-whitelist-gap-the-disclosure-process-is-still-broken/69fa20ffa386d7f121b54e29) [Lưu Tuấn Anh](https://hashnode.com/@anhlt120) · [May 6](https://hashnode.com/posts/teampcp-and-the-supply-chain-attack-campaign-spread-themselves-through-the-open-source-ecosystem/69fa9d98a386d7f121f70c60) ### [TeamPCP and the supply chain attack campaign spread themselves through the open source ecosystem](https://blog.fiscybersec.com/teampcp-and-the-supply-chain-attack-campaign-spread-themselves-through-the-open-source-ecosystem?utm_source=hashnode&utm_medium=feed) Overview From April 21 to 22, 2026, the supply chain attack campaign attributed to the TeamPCP group (or UNC6780) unexpectedly reactivated after a 26-day hiatus. This outbreak didn't stop at a single 8 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/teampcp-and-the-supply-chain-attack-campaign-spread-themselves-through-the-open-source-ecosystem?utm_source=hashnode&utm_medium=feed) [Oliver Zehentleitner](https://hashnode.com/@oliver-zehentleitner) · [May 5](https://hashnode.com/posts/the-pypi-package-was-clean-that-was-the-problem/69f9dd59a386d7f12182e775) ### [The PyPI Package Was Clean. That Was the Problem.](https://blog.technopathy.club/the-pypi-package-was-clean-that-was-the-problem?utm_source=hashnode&utm_medium=feed) A near-identical clone of my Binance WebSocket library had no payload — but it spoofed identity, shadowed the import path, linked to a 404 repo, and came from the same account as pybotnet. 13 min read · [blog.technopathy.club](https://blog.technopathy.club/the-pypi-package-was-clean-that-was-the-problem?utm_source=hashnode&utm_medium=feed) [Sai Sandeep Kantareddy](https://hashnode.com/@skantar1) · [Apr 13](https://hashnode.com/posts/building-mare-v2-from-a-pdf-retrieval-idea-to-an-evidence-first-open-source-library/69dceae9f57346bc1eff9087) ### [Building MARE v2: From a PDF Retrieval Idea to an Evidence-First Open-Source Library](https://tokenbytoken.hashnode.dev/building-mare-v2-from-a-pdf-retrieval-idea-to-an-evidence-first-open-source-library?utm_source=hashnode&utm_medium=feed) A little while ago, I wrote about an idea I kept coming back to: Most “chat with your PDF” systems optimize for fluent answers, but not for evidence. That felt backwards. In real document workflows, p 12 min read · [tokenbytoken.hashnode.dev](https://tokenbytoken.hashnode.dev/building-mare-v2-from-a-pdf-retrieval-idea-to-an-evidence-first-open-source-library?utm_source=hashnode&utm_medium=feed) [GitHubOpenSource](https://hashnode.com/@GitHubOpenSource) · [Nov 16, 2025](https://hashnode.com/posts/stop-fighting-pdf-forms-automate-everything-with-pypdfform/6919cfdc28268bc5be1294a9) ### [Stop Fighting PDF Forms: Automate Everything with PyPDFForm](https://github-open-source.hashnode.dev/stop-fighting-pdf-forms-automate-everything-with-pypdfform?utm_source=hashnode&utm_medium=feed) 📝 Quick Summary: PyPDFForm is a Python library designed for processing PDF forms. It provides functionalities to inspect form data requirements, fill forms using Python dictionaries, create form fields, extract pages, and merge multiple PDFs. 🔑 Key... 3 min read · [github-open-source.hashnode.dev](https://github-open-source.hashnode.dev/stop-fighting-pdf-forms-automate-everything-with-pypdfform?utm_source=hashnode&utm_medium=feed)