5 ms·
> I had no idea how to contact anyone related to PyPI https://pypi.org/security/ https://pypi.org/security/: > If you've identified a security issue with a pr
by notatallshaw 6mo ago
> I had no idea how to contact anyone related to PyPI
https://pypi.org/security/ https://pypi.org/security/:
> If you've identified a security issue with a project hosted on PyPI
Login to your PyPI account, then visit the project's page on PyPI. At the bottom of the sidebar, click Report project as malware.
- 0cf8612b2e1e 6mo agoThe existing account to report is an unfortunate obstacle. Presumably not a huge deal if you were auditing code for vulnerabilities, but still an annoyance.
- notatallshaw 6mo agoThe threat actor was sophisticated enough to spam GitHub issues with dozens of different accounts. I imagine they could completely overwhelm PyPI with unauthenticated reports.