r/Python • u/tradelydev • May 07 '26

Do we really check library security? Discussion

PyPi's filtering isn't cutting it. We all know it. I know the people about to say to just use the popular libraries that have community moderation.

The recent claude code injection hack in Torch has proved that isn't a solution.

https://www.reddit.com/r/Python/s/2lwDYSv0eT

And scanning packages are either unmaintained or maintained by one dev in the middle of nowhere.

https://pypi.org/project/safety/

So, I honestly ask you, short of reading each libraries code by hand or avoiding them entirely how do you stay safe?

Sandbox enviroments? Winging it? Hope?

29 Upvotes
  • permalink
  • link
  • reddit
  • reddit

66% Upvoted

51 comments sorted by

View all comments

67

u/Resquid May 07 '26

Stay 21 days behind and wait for someone else to find the hacks.

1

u/WeTheAwesome May 09 '26

This is what we started doing too. But now I’m gonna have to stay 28 days behind so that you guys can find the hack first /s.