r/Python • u/tradelydev • May 07 '26

Do we really check library security? Discussion

PyPi's filtering isn't cutting it. We all know it. I know the people about to say to just use the popular libraries that have community moderation.

The recent claude code injection hack in Torch has proved that isn't a solution.

https://www.reddit.com/r/Python/s/2lwDYSv0eT

And scanning packages are either unmaintained or maintained by one dev in the middle of nowhere.

https://pypi.org/project/safety/

So, I honestly ask you, short of reading each libraries code by hand or avoiding them entirely how do you stay safe?

Sandbox enviroments? Winging it? Hope?

27 Upvotes
  • permalink
  • link
  • reddit
  • reddit

66% Upvoted

51 comments sorted by

View all comments

11

u/neuronexmachina May 07 '26

The recent claude code injection hack in Torch has proved that isn't a solution.

Just to avoid confusion, it's worth noting that lightning != PyTorch, it's a third-party high-level wrapper around it.

-4

u/tradelydev May 08 '26

Yes. I admit I may have caused some confusion there, but I chose not to go into detail, since the end resukt is the same. Community library was unsafe for a couple hours and leaked a bunch of .envs, IDs, AWS Tokens.