Tag: Python Package Index
GitHub and PyPI Bet On Time to Slow Down Software Supply Chain Attacks
Tom Smith | | automated updates, CI/CD security, dependency cooldown, dependency pinning, dependency updates, devops security, GitHub Dependabot, lockfiles, malicious packages, open source security, package poisoning, package registry security, platform engineering, PyPi, Python Package Index, scoped access tokens, Software Supply Chain Security, supply chain attacksGitHub and PyPI are using time as a security control, delaying dependency updates and locking older releases against new file uploads ...
