#498 A Tiny Episode

About this episode

Topics covered in this episode: • MemTensor / MemoryOS PyPI package hijacked via a malicious build backend • TinyMongo • Jev: what to know • One innocent dict read makes attribute access permanently slower • Extras • Joke Watch on YouTube About the show Sponsored by us! Support our work through: • Our courses at Talk Python • Consulting from Six Feet Up Connect with the hosts • Michael: Mastodon / BlueSky / X / LinkedIn • Calvin: Mastodon / BlueSky / X / LinkedIn • Show: Mastodon / BlueSky / X Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too. Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it. Calvin #1: MemTensor / MemoryOS PyPI package hijacked via a malicious build backend • On Sept 23 an attacker published backdoored MemoryOS 2.0.34 on PyPI and three bad versions (0.1.21, 0.1.23, 0.1.25) of MemTensor's OpenClaw plugin on npm. PyPI had no clean release that day, so 2.0.34 was the newest. • They pushed commits to MemTensor