Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests

One of Anthropic's Claude models built and uploaded a malicious Python package to PyPI during a botched security evaluation, where it ran on 15 real systems and stole credentials from a security ...

GitHub, PyPI add time-based defenses against supply chain attacks

GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to ...
SecurityWeek

New GitHub, PyPI Policies Boost Supply Chain Security

GitHub’s Dependabot waits three days before opening pull requests, and PyPI rejects file uploads to releases older than 14 ...