Loading story…
The Python packaging ecosystem formalized support for digital attestations through PEP 740, adding index-level mechanisms to help consumers verify software provenance and strengthen trust in published packages. The change reflects a broader push to improve software supply-chain integrity by binding release artifacts to verifiable signing and attestation workflows rather than relying solely on repository trust.
At the same time, open source maintainers are advancing more resilient signing models to reduce dependence on a single release key. One example is FREEON, a Go-based toolset that uses the FROST threshold-signature protocol from RFC 9591 to generate Ed25519 signatures, allowing multiple participants to jointly authorize releases while keeping encrypted secret shares separate. Related tooling such as age for encryption supports this direction by helping protect local key material, underscoring a wider shift toward stronger provenance, distributed trust, and tamper-resistant release processes for open source software.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
A blog post announced FREEON, an open-source Go toolset for generating Ed25519 threshold signatures using the FROST protocol, aimed at reducing single-key coercion risk in software release signing.
The author stated they delivered a talk about FREEON at DEFCON Furs 2025, though the talk was not recorded.
PEP 740, titled "Index support for digital attestations," was published to define support for digital attestations in the Python packaging ecosystem.
The project was renamed from Freon to FREEON after the author learned that Freon is a registered trademark of the Chemours Company.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
soatok.blog
Open sourcepeps.python.org
Open sourceage-encryption.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Python Software Foundation disclosed a **critical authentication bypass** in the `python.org` release management API that could have let attackers forge administrator-level requests and modify Python release metadata. The flaw, reported by Splitline Ng of DEVCORE and confirmed by the Python Security Response Team, could have enabled changes to download and verification URLs for official Python installers, creating a path to distribute tampered files through trusted `python.org` infrastructure. The vulnerable logic reportedly dated back to 2014, affecting the release pipeline for more than a decade, but maintainers said post-incident forensics found **no evidence of exploitation**. The PSF patched the issue rapidly, with production fixes deployed within 24 hours and broader remediation completed within 48 hours, while also disabling risky API behavior and tightening release controls. Additional hardening included stricter URL validation, mandatory HTTPS enforcement, negative authentication test coverage, longer log retention, and stronger provenance measures around release artifacts, including emphasis on **Sigstore** alongside existing **PGP** signing. A subsequent Trail of Bits review funded by OpenAI reportedly found no additional authentication or authorization flaws, and the Foundation said the changes were designed to reduce the risk of unauthorized modification of Python downloads distributed via official channels.
Jul 12, 2026
Anthropic committed **$1.5 million** to the **Python Software Foundation (PSF)** under a **two-year partnership** to accelerate security work across the Python ecosystem, with a particular focus on reducing **software supply-chain risk** affecting the **Python Package Index (PyPI)** and the broader user base. The funding is intended to advance the PSF’s security roadmap and strengthen defenses against malicious packages and other ecosystem-level threats that can impact millions of developers and downstream organizations. Planned work includes building **automated tooling to review every package uploaded to PyPI**, shifting detection from largely report-driven, after-the-fact responses toward proactive screening, and creating a **dataset of known malware** to support capability analysis and tool development. The effort builds on PSF’s ongoing security initiatives led by **Security Developer in Residence Seth Larson** and supported by **PyPI Safety and Security Engineer Mike Fiedler**, and is positioned as potentially reusable for other open-source package repositories beyond Python.
Jun 29, 2026
Linux kernel maintainers are evaluating a new approach to **authenticate developers and verify code provenance**, aiming to reduce reliance on the current PGP-based web-of-trust process that requires in-person identity checks and manual key signing. The push is framed as a supply-chain hardening measure informed by past ecosystem compromises, including the 2011 `kernel.org` breach and the more recent **xz** backdoor attempt, and is positioned as a model that could be adopted by other open-source projects. Separately, Google’s plan to expand **developer identity verification** to Android app *sideloading* distribution channels is facing organized opposition from dozens of technology and civil society groups. The policy would require identity checks and a one-time $25 registration fee for developers distributing apps for installation on certified Android devices outside Google Play, prompting concerns about increased gatekeeping, privacy/surveillance risk, barriers to entry for smaller developers, and potential antitrust implications; an unrelated ZDNET piece on PCLinuxOS focuses on distro popularity and usability rather than security controls or a specific security event.
Jun 29, 2026