Over 700 Malicious Typosquatted Libraries Found On RubyGems Repository.

https://thehackernews.com/2020/04/rubygem-typosquatting-malware.html

@stman

Topic of signed gems seems to have been last raised in... 2013 https://github.com/rubygems-trust

@stman

#python packages could have PGP signatures like forever (twine --sign), but predictably nobody uses it.

There's an active discussion on PEP 458 to sign packages at pypi (centrally) https://discuss.python.org/t/pep-458-secure-pypi-downloads-with-package-signing/2648/123

@clacke @stman

Correct. And PyPi.org does ensure unique package names but then it doesn't really help - I've just spend half hour debugging an issue caused by the fact I installed "yara" package while the one I wanted is called "yara-python" 🤦‍♂️