I'm really glad this is being taken seriously. It's often been an uphill battle to convince people that Python supply chain security is a serious issue.
In the ML (now called AI) space for example, it's not uncommon to download random binaries from the internet containing model weights, scripts, etc. Sometimes even at runtime (!!!) Lots of bad practices across the industry there that wouldn't be tolerated in other contexts.
In the ML (now called AI) space for example, it's not uncommon to download random binaries from the internet containing model weights, scripts, etc. Sometimes even at runtime (!!!) Lots of bad practices across the industry there that wouldn't be tolerated in other contexts.