A deep-dive podcast episode covering the first-ever dedicated security track at PyCon US 2026, featuring Seth Larson (PSF Security Developer-in-Residence), Mike Fiedler (PyPI Safety & Security Engineer), and Juanita Gomez (PhD researcher). Topics include a real phishing campaign against PyPI maintainers using a transparent proxy at a look-alike domain, why TOTP 2FA is phishable while passkeys/WebAuthn are not, the supply chain attack that compromised num2words (a transitive dependency of Hugging Face Transformers), dependency cooldowns as a low-effort protective default, trusted publishing via OpenID Connect, GitHub Actions security risks (pull_request_target), SBOMs and the SBOMit project, runtime SBOM generation from Python memory, bringing Rust into CPython for memory safety, and the limitations of the CVE system for tracking malware. Practical recommendations include adopting phishing-resistant authentication, enabling trusted publishing and deleting old API tokens, running zizmor on repositories, and supporting open source security funding.
