eLife

Disentangling cephalopod chromatophores motor units with computer vision

The spatial organization of chromatophore-muscle innervation by motoneurons enables the generation of chromatophore-shaped noise, virtual or composite chromatophores, and shape elements such as lines ...

The GitHub Actions Attack Pattern Your CI Security Scanners Miss

ActiveState explains how GitHub Actions attack chains can evade traditional CI security scanners, why passing a scan doesn't ...
IEEE

DySec: A Machine Learning-Based Dynamic Analysis for Detecting Malicious Packages in PyPI Ecosystem

Abstract: Malicious Python packages make software supply chains vulnerable by exploiting trust in open-source repositories like Python Package Index (PyPI). Lack of real-time behavioral monitoring ...
eLife

TopoMetry systematically learns and evaluates the latent geometry of single-cell data

A framework for analyzing single-cell genomics data, in which geometrical properties are harnessed to obtain insights on cellular diversity, including precise clustering, clear visualizations, and ...

Vector Institute releases UnBias-Plus, a free, open-source AI tool to detect and rewrite bias in text

The Vector Institute today launched UnBias-Plus , a free, open-source AI tool built by Vector's AI Safety research scientists that helps detect, explain, and rewrite biased language in written content ...
Meduza

Russia’s federal censor denies blocking Python’s package index as developers scramble for workarounds

On Monday, Russian users found they could no longer reach PyPI, the package repository that Python developers rely on for code libraries.
VentureBeat

Protect your enterprise now from the Shai-Hulud worm and npm vulnerability in 6 actionable steps

Any development environment that installed or imported one of the 172 compromised npm or PyPI packages published since May 11 should be treated as potentially compromised. On affected developer ...
Bleeping Computer

Shai Hulud attack ships signed malicious TanStack, Mistral npm packages

Hundreds of packages across npm and PyPI have been compromised in a new Shai-Hulud supply-chain campaign delivering credential-stealing malware targeting developers. The attacker hijacked valid OpenID ...
SecurityWeek

TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack

Over 170 packages across multiple high-profile NPM and PyPI projects were compromised in a new, coordinated Mini Shai-Hulud software supply chain attack. The campaign hit 42 TanStack packages, 65 ...
GitHub

A Python library and optional CLI tool for PyPI package stats and download analytics, built on the official pypistats API. Fetch daily, weekly, monthly, and 180-day downloads ...

get_package_stats(name, *, no_cache=False, cache_ttl=None) Fetch all statistics for a PyPI package. Returns a PackageStats object. clear_cache() Clear all cached API responses. get_cache_info() Return ...
IEEE

Detecting Malicious Packages in PyPI and NPM by Clustering Installation Scripts

Abstract: Software repositories such as PyPI and npm are vital for software development but expose users to serious security risks from malicious packages. The malicious packages often execute their ...