
Research
lightning PyPI Package Compromised in Supply Chain Attack
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.
boltons
Advanced tools
boltons should be builtins.
Boltons is a set of over 230 BSD-licensed, pure-Python utilities in the same spirit as — and yet conspicuously missing from — the standard library, including:
Full and extensive docs are available on Read The Docs. See what's new by checking the CHANGELOG.
Boltons is tested against Python 3.7-3.13, as well as PyPy3.
Boltons can be added to a project in a few ways. There's the obvious one:
pip install boltons
On macOS, it can also be installed via MacPorts:
sudo port install py-boltons
Then, thanks to PyPI, dozens of boltons are just an import away:
from boltons.cacheutils import LRU
my_cache = LRU()
However, due to the nature of utilities, application developers might want to consider other options, including vendorization of individual modules into a project. Boltons is pure-Python and has no dependencies. If the whole project is too big, each module is independent, and can be copied directly into a project. See the Integration section of the docs for more details.
The majority of boltons strive to be "good enough" for a wide range of
basic uses, leaving advanced use cases to Python's myriad specialized
3rd-party libraries. In many cases the respective boltons module
will describe 3rd-party alternatives worth investigating when use
cases outgrow boltons. If you've found a natural "next-step"
library worth mentioning, see the next section!
Found something missing in the standard library that should be in
boltons? Found something missing in boltons? First, take a
moment to read the very brief architecture statement to make
sure the functionality would be a good fit.
Then, if you are very motivated, submit a Pull Request. Otherwise, submit a short feature request on the Issues page, and we will figure something out.
FAQs
When they're not builtins, they're boltons.
We found that boltons demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.