
Security News
Federal Government Rescinds Software Supply Chain Mandates, Makes SBOMs Optional
The U.S. government is rolling back software supply chain mandates, shifting from mandatory SBOMs and attestations to a risk-based approach.
morty-package
Advanced tools
I tightened my mask at the edge of the index, where names float light as foam— friendly, documented, smiling in README sunlight.
Then I sank.
Below the surface, PyPI is not a library but an ocean trench, where versions drift like sediment and forgotten wheels rust quietly under pressure no tutorial mentions.
I descend past setup.py fossils, past sdist bones cracked by time, watching metadata glow faintly like bioluminescent warnings: PEP 517, isolated build, exec at import time.
Here, code does not sleep. It waits.
I shine my torch into a dependency chain and see shadows moving— hooks, side effects, a harmless helper that pulls another, and another, until the water grows thick with assumptions.
Currents whisper: “Wheels don’t run me.” “Sdists still do.”
I pass shipwrecks of yanked releases, names spelled almost right, typos that once fed on human haste before copy-paste starved them.
Deeper still, where pressure crushes naïveté, I find the quiet truth: nothing is magic, only layers— path resolution, import order, what is promised, and what is merely assumed.
At the bottom, there is no monster. Only mirrors.
The diver surfaces changed, salt in their hair, knowing that the danger was never the depth— but forgetting that water always runs code before you see it breathe.
FAQs
Exploring the inner mechanics of PyPI packaging
We found that morty-package demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The U.S. government is rolling back software supply chain mandates, shifting from mandatory SBOMs and attestations to a risk-based approach.

Security News
crates.io adds a Security tab backed by RustSec advisories and narrows trusted publishing paths to reduce common CI publishing risks.

Research
/Security News
A Chrome extension claiming to hide Amazon ads was found secretly hijacking affiliate links, replacing creators’ tags with its own without user consent.