{"podcast":{"title":"Python Bytes","slug":"python-bytes","podcast_index_feed_id":1021771,"rss_url":"https://pythonbytes.fm/episodes/rss","website_url":"https://pythonbytes.fm/","image_url":"https://cdn.pythonbytes.fm/static/img/podcast-theme-img_1400.jpg","author":"Michael Kennedy","episode_count":478,"summary":"Python Bytes is a weekly podcast hosted by Michael Kennedy and Brian Okken. The show is a short discussion on the headlines and noteworthy news in the Python, developer, and data science space.","last_synced_at":null,"page_url":"https://stenobird.com/podcast/python-bytes"},"episode":{"title":"#464 Malicious Package? No Build For You!","slug":"464-malicious-package-no-build-for-you","published_at":"2026-01-05T08:00:00+00:00","page_url":"https://stenobird.com/podcast/python-bytes/464-malicious-package-no-build-for-you","show_page_url":"https://stenobird.com/podcast/python-bytes","url":"https://pythonbytes.fm/episodes/show/464/malicious-package-no-build-for-you","audio_url":"https://pythonbytes.fm/episodes/download/464/malicious-package-no-build-for-you.mp3","summary":"Explore the performance benefits of the new UV TY type checker and learn how to secure your Python supply chain. This episode covers strategies for detecting malicious packages before they reach your local development environment.","meta_description":"Learn how to use UV TY for lightning-fast type checking and implement Docker-based pip-audit workflows to prevent malicious Python package installations.","key_points":["Main idea: UV TY provides an extremely fast Python type checker and LSP that significantly outperforms traditional tools like MyPy","Practical takeaway: Use a time-delay strategy when updating dependencies to avoid the 'window of vulnerability' where new malicious packages haven't been flagged yet","Practical takeaway: Implement an isolated Docker-based audit workflow to run pip-audit on requirements before installing them on your host machine","Failure mode: Running pip-audit after installation is often too late, as malicious packages can execute code or install rootkits during the installation process","Practical takeaway: Integrate pip-audit into your Docker build process using build-time caching to ensure no vulnerable containers are ever deployed"],"chapters":[{"start_ms":60000,"title":"UV TY: High-Speed Type Checking","summary":"An introduction to UV TY, a new extremely fast Python type checker and Language Server Protocol (LSP) currently in beta."},{"start_ms":195000,"title":"Performance Benchmarks","summary":"Comparing the execution speed of UV TY against MyPy and Pyright on large-scale projects."},{"start_ms":330000,"title":"VS Code Integration","summary":"Details on using the UV TY extension for VS Code, including features like inlay type hints and go-to-definition."},{"start_ms":595000,"title":"The Python Supply Chain Threat","summary":"Discussing the risks of transitive dependencies and how malicious actors exploit the delay in package reporting."},{"start_ms":735000,"title":"Securing the Build Pipeline","summary":"Using Docker and pip-audit to create a safe sandbox for testing new dependencies and preventing vulnerabilities in CI/CD."},{"start_ms":875000,"title":"The Danger of Post-Install Auditing","summary":"Why auditing packages after they are installed on a dev machine is a critical security failure."},{"start_ms":1145000,"title":"Managing Typing Extensions","summary":"The challenges of maintaining backward compatibility and managing typing decorators across different Python versions."}],"topics":["Python","Type Checking","Supply Chain Security","Software Development","DevOps","Docker","Package Management","Cybersecurity"],"duration_seconds":1818,"processing_state":"processed","actions":[{"name":"request_transcript","method":"POST","url":"https://stenobird.com/v1/public/podcasts/python-bytes/episodes/464-malicious-package-no-build-for-you/transcription-requests","description":"Idempotently request low-priority transcript generation for this episode."},{"name":"read_markdown","method":"GET","url":"https://stenobird.com/podcast/python-bytes/464-malicious-package-no-build-for-you.md","description":"Read the agent-friendly Markdown representation of this episode resource."}]}}