KEIP

Summary from the TLDR InfoSec newsletter

KEIP uses eBPF/LSM hooks to intercept and block malicious network connections made by Python packages at install time, targeting the phase where over 56% of supply chain attacks occur. It enforces behavioral rules at the kernel level: allowlisting ports 80/443/53, capping unique IP contacts at 5, and limiting outbound data ratios, killing the entire process group on violation with under 50ms overhead.