PyPI+ - Python Package Explorer with Dependency Visualization | Search 500K+ Packages
Another handy tool for diving into the depdencies of Python packages as found on PyPI.
Supply Chain Security Alert: num2words PyPI Package Shows Signs of Compromise - StepSecurity
Interesting supply chain attack on a Python package.
Packing Python Projects
This tutorial walks you through how to package a simple Python project. It will show you how to add the necessary files and structure to create the package, how to build the package, and how to upload it to the Python Package Index (PyPI).
Phylum Discovers Dozens More PyPI Packages Attempting to Deliver W4SP Stealer in Ongoing Supply-Chain Attack
"Last week, our automated risk detection platform alerted us to some suspicious activity in dozens of newly published PyPI packages. It appears that these packages are a more sophisticated attempt to deliver the W4SP Stealer on to Python developer’s machines by hiding a malicious import . Join us here on the Phylum research team as we investigate these new and shifting tactics the attacker is using to deploy W4SP stealer in this supply-chain attack."