How to Audit All Python Virtual Environments for Compromised Packages Without Executing Python
The growing number of supply-chain attacks targeting popular packages has prompted developers to seek reliable ways to audit their Python installations. Recent incidents affected the npm package Axios, the vulnerability scanner Trivy, and the Python package LiteLLM. In response, one developer created a system to locate every virtual environment on a machine and inspect its installed packages without ever executing Python code.
Virtual environments isolate project dependencies by storing symbolic links to the Python interpreter and site-packages inside a dedicated directory, conventionally named .venv. Because Python itself does not track created environments, the author maintains a personal registry file at ~/.venv_registry that is updated both by periodic find commands and by a shell function that records every newly created environment.
The registry enables a simple Bash script that reads each path, verifies the directory still exists, and then calls uv pip freeze --python against the environment’s interpreter. Because uv is written in Rust, it parses installation metadata without running any Python code—an important safeguard after the LiteLLM compromise demonstrated that even innocuous commands such as python --version could execute attacker-controlled .pth files.
The same registry supports additional security and maintenance tasks. It can be used to identify outdated package versions across all projects, locate remaining usages of libraries the developer wishes to retire, and search project source trees for calls to specific functions without scanning the entire disk.
Global installations outside virtual environments are prevented by setting PIP_REQUIRE_VIRTUALENV=true and by relying on uv, which refuses to modify the system Python unless the --system flag is explicitly supplied. The resulting workflow therefore provides both rapid detection of known malicious packages and ongoing hygiene for a large collection of Python projects on macOS.
Related articles
LiteLLM Supply Chain Poisoning Exposes 195TB of Credentials Across 2500 Organizations
A detailed forensic report from CloudSEK and Hudson Rock reveals that attackers compromised the LiteLLM CI/CD pipeline by poisoning the Trivy security scanner dependency. The malicious Trivy tag allowed theft of PyPI publishing tokens, leading to the upload of tainted LiteLLM versions 1.82.7 and 1.82.8. Within a 40-minute attack window these packages were downloaded over 119,000 times, exfiltrating 195TB of credentials including AWS, Azure, GCP keys, GitHub tokens, SSH keys, Kubernetes configs, and AI provider API keys. NVIDIA and multiple other major technology firms were confirmed among the victims. The incident highlights critical weaknesses in dependency pinning practices and the absence of automated detection for malicious package behavior on PyPI. Experts warn that AI infrastructure components are becoming high-value targets for future supply-chain campaigns.
Linux Foundation Report Reveals Why Companies Fork Open Source Projects and Maintain Internal Patches
A new Linux Foundation Research study of 567 IT professionals shows that organizations actively modify open source components rather than using them unchanged. While 72% contribute back to projects in some form, many maintain internal forks due to missing features, integration needs, security timelines, and regulatory requirements. The average organization supports 86 internal forks, consuming over 5,000 hours per release cycle. The largest gaps between business-critical technologies and actual contributions appear in programming languages and databases. The findings highlight growing supply-chain risks when internal branches diverge from upstream projects without proper tracking of patches and commits.
Where Secrets Really End Up in Docker Images: Testing 8 Common Methods
A detailed analysis of eight different approaches for handling secrets during Docker image builds reveals that most methods leave sensitive data exposed in layers, configuration files, or build history. Experiments conducted on Ubuntu 24.04.1 LTS with Docker Engine 29.1.3 and BuildKit v0.26.2 showed that simply using RUN rm after COPY or overwriting files fails to remove secrets from immutable layers. Environment variables via ENV and build arguments via ARG both persist in image metadata and history. Only BuildKit Secrets with --mount=type=secret and multi-stage builds that avoid copying secrets into the final stage successfully prevent leakage. The study demonstrates that secrets can be extracted from saved images without running any containers. Developers are advised to adopt these two secure patterns to protect credentials in container supply chains.
Mozilla Revokes GPG Signing Key After Accidental Upload to Private GitHub Repository
Mozilla has replaced the GPG key used to sign certain Firefox and Thunderbird builds following an accidental exposure of the unencrypted secret key in a private GitHub repository. The key was intended for signing Linux archives, RPM packages, and checksum files, raising theoretical risks of supply-chain attacks through forged installers. Company audits found no evidence of external misuse, as repository access was limited to a small group of employees who already held legitimate access to the key. Most users require no action, though those manually verifying GPG signatures must import the new key along with revocation data for the old one. Linux administrators installing Firefox via RPM packages on distributions such as Fedora, RHEL, Rocky Linux, AlmaLinux, openSUSE, and SUSE may need to manually update the key to avoid installation failures. Thunderbird users are unaffected by the RPM issue since no official RPM packages are released for the email client. The new key remains valid until August 5, 2028, with public details available in updated KEY files and on keys.openpgp.org.