Attributed metadata history
Up to 100 retained publisher events per page for 1a6cc05a8da505dddb2b998385e2ac39a03e6e9bf40108f68ec16b493f87b223. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_c25d91fa3ad9ae9ac7
observed · 2026-10-12 14:53:03 UTC
This week I learned about a design flaw with pip download, which allows an adversary to run arbitrary code. I assumed that running pip install means anything could happen, but pip download seems a bit surprising. Both seem useful for red teaming though. Background This post from Yehuda Gelb named Automatic Execution of Code Upon Package Download on Python Package Manager which the Security Now! podcast pointed me towards. The post highlights that just running pip download can compromise your computer.
Fingerprint: 93ea29832cafdc62de1f18e45c5b8b5e1f65037543522d9bb47aa61704901804
intelligence_src_c25d91fa3ad9ae9ac7
observed · 2026-10-12 14:53:03 UTC
available
Fingerprint: 0a2f1bebc7ea800736eafab237a0ddecfb8797a02d23951e8aa80935e2f3446f