Pydantic 作者惊呼:Python 全生态暴露,同日多起投毒事件疑刻意压新闻

samuelcolvin · x · 2026-10-22

Pydantic author samuelcolvin flags a wave of open-source supply chain security incidents, questioning whether their simultaneous publication was a "bury bad news" tactic.
He argues the situation looks intractable: every CPython install, venv, and UV is at risk in the Python ecosystem alone, let alone npm, pnpm, yarn, go, and rust.
His tongue-in-cheek 2026 security posture: stay home, connect only via a trusted ISP — "winter is coming."

「安全」频道最新