"Security considerations in Python Packaging"
summary
Cites a paper that finds security issues in about 46% of PyPI packages and walks through concrete tools: Bandit (file-by-file AST checks, baseline comparisons, JSON output, and custom test hooks), safety / Safety DB (checks virtualenv or requirements.txt, supplies insecure.JSON and monthly CVE sync), and semgrep (1,000+ community rules, CI integration, online playground). Recommends scanning before and after install, verifying GPG signatures and official sources, and upgrading specific vulnerable versions rather than avoiding packages wholesale.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:31Talk Outline
- 5:22Importance of Secure package
- 8:03Bandit usage
- 9:57Bandit Writing Tests
- 11:38Bandit Plugin ID Groupings
- 15:05safety check
- 18:59Safety DB usage
- 19:41Safety DB Tools
- 20:36Semgrep: Open-source static analyser
related talks
35mSecuring Python projects Supply Chain
34mSecure Python Development: Tips, Tricks, and Tools
18mMalicious Needle in a Haystack – PyPi Security Pitfalls
20mMalicious Needle in a Haystack - PyPi Security Pitfalls
29mMaking Python safer than ever
54mPython Security Best Practices Against Vulnerabilities
26mSecure Software Supply Chains for Python
31mChoosing Wisely - How to Pick the Right Third Party Packages for your Project