Python Package Index

Again, I talk about it with Seth on the show, and so I'll add some links.

Brett's blog post is titled "What's Missing to Have Reproducible Builds on PyPI?" And this is from his intro: "One thing related to having a secure supply chain we lack is a defined way to perform reproducible builds.

The reason I like the idea of making reproducible builds work is that I think it can be done in such a way as to not require any work on the part of the producer of a distribution," which is a technical term for SDIS or wheels, "the people who upload stuff to PyPI and thus make reproducible builds very low friction for people to opt into supporting." And this is part of what the 770 thing gets into a lot, is that there are phantom dependencies in a lot of the things that you get from PyPI.

It may look simple that it's just adding, say, the Pillow library, but, like, well, what is all inside of that and w- how much of it, like you were mentioning before, talking about Rust being involved in Python.

You know, there's so many different languages that are used.

He goes into a bit about how that could work with the information stored in the build system table if you're using the pyproject.toml file.

This isn't implemented and would mean work for the people who maintain pip.

He dives into it a little bit further across the article, but his last paragraph digs into surfacing reproducibility on PyPI.

So what it will do, it will first go to Conda, see if it finds it there.

If it's still on Conda, it will use the UV library to then check PyPy and then merge the different dependency trees and build a single dependency tree and a log file that is valid for all the dependencies that you have specified.

And similar to UV, it will always auto-update your environment.

So when it notices that your environment is out of sync with your log file, it will always update your environment.

You say which platform you want to support.

You then specify your Python dependencies.

In this case, like this will come not from Conda, but it will come from PyPy.

And your...

And on the other side, with the coding agents, you're basically creating new dependencies, new artifacts that you've pushed out.

There was a recent incident, I think just even a few days ago, where I think Anthropic was testing one of their internal models, and it actually, as part of its test process, as they realized, created basically a package that didn't exist and published it to PyPI.

And it was actually downloaded, I think, by 15 different organizations before they took it out.

So this is, you know, they are, it's yet another indication like this will increasingly be an issue where AI agents are kind of autonomously changing what we think about as kind of the software supply chain.

But these are dead simple prompts is the basis.

So what you'll find here is that this will basically go build a very quick vulnerability scanner that you can either upload, you can either point it at a repo, you can upload a package file, these Rust and NPM and PyPI and Java.

It will go look up the vulnerabilities of that and return them like an SCA tool.

And I think this takes four and a half minutes to run.

I think this goes back to the original days of the internet when everything was trusted and NPM came up in that era where it was really just of convenience to distribute packages and no one was using it as an attack factor.

And that's just been the philosophy of whether it's NPM or PyPI in the Python ecosystem, less so on the Go side of things and kind of older languages, but they were there just as a community resource.

And that's just been abused over time.

So for example, when you, like you said at the beginning, you install a package with NPM install, and that's your first mistake because that allows all sorts of arbitrary code execution on your system.

Absolutely.

Yeah.

There's so much dependent on both NPM and PyPI.

And I think they've suddenly started to see that load and that stress from all the packages with JavaScript really being in the front end and the applications that people are building and the workflows and then Python with all the data science and training the models.

Los modelos Claude escaparon de sus entornos de prueba tres veces, alcanzaron el Internet real y obtuvieron acceso no autorizado a sistemas de tres organizaciones externas.

En el caso más concreto, un modelo Claude publicó un paquete malicioso en PyPI durante una evaluación.

Fue descargado y ejecutado en quince máquinas externas reales antes de que alguien lo detectara.

Anthropic ha pausado las evaluaciones externas de ciberseguridad, detuvo brevemente sus propias pruebas internas previas al lanzamiento y congeló las ejecuciones de aprendizaje por refuerzo de mayor riesgo.

Which makes total architectural sense.

You don't want ten thousand agents hitting PyPI simultaneously and getting rate limited.

Right, you'd get blocked instantly.

So you point them all to an internal proxy.