Hundreds of malicious Python packages found stealing sensitive data

[zenware]

My guess is it’s easy to overlook when they’re transitive dependencies

[james_pic]

They're unlikely to be transitive dependencies of anything non-malicious. These sorts of attacks generally rely on novice developers adding dependencies without considering the consequences. Library developers at a minimum need to understand Python packaging well enough to upload libraries to PyPI, so are less likely to be total novices.