Record · corpus.blog/posts/01a0873d-a123-73a9-9f46-88e8f3a45343

Defense in Depth: A Practical Guide to Python Supply Chain Security

bernat.tech · published 10 March 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at bernat.tech Wayback capture

1blogs citing

First cited: 24 Mar 2026
Most recent: 24 Mar 2026
Rank this month: not ranked
External links: 66
Words captured: 8,044

Cited by

Blog

In the post

Date

Shellsharks

Scroll trīgintā quattuor Read at the source ↗

24 Mar 2026

Links from this post

Link

Host

https://github.com/pypa/pip-audit

github.com

https://tag-security.cncf.io/community/working-groups/supply-chain-security/supply-chain-security-paper-v2/Software_Supply_Chain_Practices_whitepaper_v2.pdf

tag-security.cncf.io

https://www.crowdstrike.com/en-us/blog/how-crowdstrike-detects-poisoned-python-packages-ctx-phpass/

crowdstrike.com

Preventing Domain Resurrection Attacks Read at the source ↗

blog.pypi.org

https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/

blog.pypi.org

PyPI Users Email Phishing Attack Read at the source ↗

blog.pypi.org

New Login Verification for TOTP-based Logins Read at the source ↗

blog.pypi.org

Token Exfiltration Campaign via GitHub Actions Workflows Read at the source ↗

blog.pypi.org

https://www.bleepingcomputer.com/news/security/pypi-invalidates-tokens-stolen-in-ghostaction-supply-chain-attack/

bleepingcomputer.com

PyPI and Shai-Hulud: Staying Secure Amid Emerging Threats Read at the source ↗

blog.pypi.org

https://docs.zizmor.sh/

docs.zizmor.sh

https://pypi.org/security/

pypi.org

https://docs.astral.sh/ruff/

docs.astral.sh

https://bandit.readthedocs.io/en/latest/

bandit.readthedocs.io

https://docs.astral.sh/ruff/rules/

docs.astral.sh

https://docs.astral.sh/ruff/rules/hardcoded-password-string/

docs.astral.sh

https://docs.astral.sh/ruff/rules/hashlib-insecure-hash-function/

docs.astral.sh

https://docs.astral.sh/ruff/rules/request-without-timeout/

docs.astral.sh

https://docs.astral.sh/ruff/rules/suspicious-pickle-usage/

docs.astral.sh

https://docs.astral.sh/ruff/rules/hardcoded-sql-expression/

docs.astral.sh

https://docs.astral.sh/ruff/rules/suspicious-eval-usage/

docs.astral.sh

https://github.com/ossf/s2c2f

github.com

https://securityscorecards.dev/

securityscorecards.dev

Preventing ZIP parser confusion attacks on Python package installers Read at the source ↗

blog.pypi.org

https://docs.astral.sh/uv/

docs.astral.sh

https://docs.astral.sh/uv/concepts/projects/

docs.astral.sh

https://docs.astral.sh/uv/reference/cli/

docs.astral.sh

pip-tools

github.com

https://pip.pypa.io/en/stable/topics/secure-installs/

pip.pypa.io

https://peps.python.org/pep-0751/

peps.python.org

https://packaging.python.org/en/latest/specifications/index-hosted-attestations/

packaging.python.org

https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain

docs.github.com

https://docs.renovatebot.com/

docs.renovatebot.com

https://nvd.nist.gov/vuln/detail/CVE-2024-22195

nvd.nist.gov

https://pypi.org/project/pip-audit/

pypi.org

https://osv.dev/

osv.dev

https://github.com/pypa/advisory-database

github.com

https://github.com/advisories

github.com

https://nvd.nist.gov/

nvd.nist.gov

https://github.com/pyupio/safety

github.com

https://calmops.com/programming/python/dependency-security-vulnerability-scanning/

calmops.com

https://www.cisa.gov/resources-tools/resources/minimum-requirements-vulnerability-exploitability-exchange-vex

cisa.gov

https://cyclonedx.org/

cyclonedx.org

https://spdx.dev/

spdx.dev

https://github.com/CycloneDX/cyclonedx-python

github.com

https://cyclonedx-bom-tool.readthedocs.io/en/latest/

cyclonedx-bom-tool.readthedocs.io

https://sbomify.com/guides/python/

sbomify.com

https://docs.astral.sh/uv/concepts/indexes/

docs.astral.sh

Trusted Publishing is popular, now for GitLab Self-Managed and Organizations Read at the source ↗

blog.pypi.org

Securing PyPI accounts via Two-Factor Authentication Read at the source ↗

blog.pypi.org

PyPI in 2025: A Year in Review Read at the source ↗

blog.pypi.org

https://docs.pypi.org/trusted-publishers/

docs.pypi.org

https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/

packaging.python.org

https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-deployments/managing-environments-for-deployment

docs.github.com

https://docs.zizmor.sh/audits/

docs.zizmor.sh

https://github.com/zizmorcore/zizmor-action

github.com

https://marketplace.visualstudio.com/items?itemName=zizmor.zizmor-vscode

marketplace.visualstudio.com

https://www.sigstore.dev/

sigstore.dev

https://peps.python.org/pep-0740/

peps.python.org

https://trailofbits.github.io/are-we-pep740-yet/

trailofbits.github.io

https://github.com/in-toto/attestation

github.com

https://slsa.dev/

slsa.dev

https://github.com/actions/attest

github.com

https://openssf.org/

openssf.org

https://blog.pypi.org/posts/2024-12-30-quarantine/

blog.pypi.org

https://peps.python.org/pep-0700/

peps.python.org