pypi supply chain

The pypi supply chain tag covers threats and incidents involving malicious packages distributed through the Python Package Index (PyPI). Recent content highlights a campaign where three versions of Microsoft's durabletask package (1.4.1–1.4.3) were compromised, carrying a Linux-focused payload that steals cloud credentials and can wipe disks. This attack underscores how developer machines and CI runners are prime targets due to their access to source code, cloud identities, and deployment keys. The tag focuses on supply chain risks in the Python ecosystem, including package poisoning, credential theft, and the broader implications for software development security.