Andy from Lightning here. The malicious code was not submitted to the main repo ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

andymcsherry 3 months ago | parent | context | favorite | on: Shai-Hulud Themed Malware Found in the PyTorch Lig...

Andy from Lightning here. The malicious code was not submitted to the main repo at Github. It appears our PyPi credentials were leaked and compromised packages were published directly there for versions 2.6.2 and 2.6.3

lostmsu 3 months ago [–]

I vaguely remember PyPi requiring 2FA about a year and a half ago at least for logins.

If they haven't started yet, they should require 2nd factor for publishing as well.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact