UPDATE: This campaign is still unfolding. Currently, the actor appears to have typosquatted several major packages in PyPI. We will continue to update this blog post as new details emerge. In November of

💡 tl;dr - We built a tool to sandbox package installations (e.g., npm install ). It’s open source, available as part of our CLI, and supports npm, yarn, and poetry out of

Overview NPM has made great strides in improving the security of the ecosystem, adding nice features like identifying potential typosquats before the packages are published. Despite this, however, malicious packages continue to be

Phylum has uncovered yet another malware campaign waged against PyPI users. And once again, the attack chain is complicated and obfuscated, but it’s also quite novel and further proof that supply chain

On the morning on December 20th, Phylum’s automated risk detection platform alerted us to a series of suspicious publications on NPM. They are all published by the user yandex.pizda who claims