ANNOUNCING CHAINGUARD LIBRARIES FOR PYTHON: MALWARE-RESISTANT DEPENDENCIES BUILT SECURELY FROM SOURCE

Summary from the TLDR InfoSec newsletter

Chainguard's Libraries for Python is a secure index that rebuilds Python packages and their dependency trees from source within a Supply-chain Levels for Software Artifacts (SLSA) Level 2-hardened setup to prevent supply chain threats. The platform specifically addresses Python wheels with native code and re-bundled OS libraries, such as OpenSSL, which create "software dark matter" that is hidden from SCA scanners. Early testing indicates that 98% of known malicious packages would be identified and blocked. This development follows notable incidents in 2023 and 2024 that involved attacks on PyTorch and Ultralytics YOLO where compromised builds and leaked API tokens facilitated malware distribution via PyPI.