🤦🏾 Another very interesting read on using backdoors to publish malway via PyPi:

An attacker took over a maintainer’s GitHub account, used the project’s own CI to steal its publishing token, and then uploaded a poisoned

0.7.4

straight to PyPI. The malicious code was injected into the published artifact only, so anyone reading the GitHub source would have seen nothing wrong.

stepsecurity.io/blog/compromised-pypi-mrmustard-0-7-4-credential-stealer

lol I was like what is Mr Mustard? I think it's safe to say that I won't be doing any quantum photonics

I agree. But the example shows the vectors bad actors are using. Might be some other library tomorrow. 🫣