Hacker News new | ask | show | jobs
by ed_balls 1812 days ago
How do you make sure your dependencies are not tampered with? https://medium.com/@alex.birsan/dependency-confusion-4a5d60f...
1 comments
Tipewryter 1812 days ago
That is a very broad question. Can you mention a specific attack vector? Then I might be able to explain how I do or do not avoid it.
link
ed_balls 1811 days ago
The link describes the attack vector. pipenv locks the dependencies using hash. if you company has my-company-py-lib then pip could install public library that pretends to be internal.
link