Mitigate supply-chain attacks for Python dependencies

This article discusses the growing threat of supply-chain attacks targeting Python dependencies, citing recent examples like LiteLLM, axios, and tanstack. It emphasizes the risks of blindly adding packages and offers mitigation strategies: reducing dependencies, writing custom code, or self-hosting registries. The main focus is on "dependency cooldowns"—waiting before installing freshly published packages to allow the community to catch malicious ones. It provides practical guidance on configuring cooldowns in popular Python package managers like uv and poetry, with code examples for pyproject.toml. The article is relevant for developers and DevOps professionals aiming to secure their software supply chain.