
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
pinginstaller
Advanced tools
Light-weight application for installing PINGMapper and associated packages. PINGInstaller is designed to install a conda environment from a yml specified as a URL or localy hosted yml.
Example yml file structure:
name: ping
channels:
- conda-forge
dependencies:
- python<3.13
- gdal
- numpy
- git
- pandas
- geopandas
- pyproj<3.7.1
- scikit-image
- joblib
- matplotlib
- rasterio
- h5py
- opencv
- pip
- pip:
- pingverter
- pingmapper
- pingwizard
- pinginstaller
- doodleverse_utils
- psutil
- tensorflow
- tf-keras
- transformers
- rsa
The special thing about PINGInstaller is that it will install the conda environment based on the conda prompt it is launched from. This enables end-users with multiple conda installations to choose the flavor of conda as needed.
Supported prompts include (but may not be limited to):
PINGInstaller is also compatible with projects in the Doodlevers.
Open (download, if not already available) the conda prompt you want to use (ex: On Windows 11 - Start --> All --> Anaconda (miniconda3) --> Anaconda Powershell Prompt).
Install PINGInstaller in the base environment with:
pip install pinginstaller
Then install the environment from a web or locally hosted yml with:
python -m pinginstaller https://github.com/CameronBodine/PINGMapper/blob/main/conda/PINGMapper.yml
That's it! Your environment is now ready to use.
If you want to update the environment, simply re-run the environment installation script with:
python -m pinginstaller https://github.com/CameronBodine/PINGMapper/blob/main/conda/PINGMapper.yml
Ta-ta for now!
Problem: When updating via PINGWizard, you see:
remove_all: Access is denied.
Cause: In rare cases, file locking can prevent updates when the wizard is running from the environment being updated.
Solution: PINGWizard (v1.0.12+) automatically runs updates from the base environment to avoid this. If you still see this error:
pip install pingwizard -Uconda activate base && python -m pingwizardProblem: When creating an environment, you see:
error libmamba Non-conda folder exists at prefix - aborting.
critical libmamba Non-conda folder exists at prefix - aborting.
Cause: A leftover directory exists at the environment location (e.g., Z:\miniforge3\envs\ping) that's not a valid conda environment. This can happen after an incomplete removal or failed installation.
Solution: Manually remove the directory and try again:
# Windows PowerShell
Remove-Item -Recurse -Force "Z:\miniforge3\envs\ping"
# Then retry installation
python -m pinginstaller
# Linux/Mac
rm -rf ~/miniforge3/envs/ping
# Then retry installation
python -m pinginstaller
Problem: Environment creation takes a very long time (>10 minutes).
Solutions:
Use mamba (much faster): Install mamba in your base environment:
conda install -n base mamba -y
PINGInstaller automatically detects and uses mamba when available.
Check your network connection: Slow downloads can cause delays.
Clear conda cache:
conda clean --all -y
Problem: Conda/mamba cannot find required packages or conflicts prevent solving.
Solutions:
Update conda/mamba:
conda update -n base conda -y
# or if using mamba
mamba update -n base mamba -y
Check channel configuration: Ensure conda-forge is available:
conda config --show channels
# Should include conda-forge
Update all packages in base:
conda update --all -y
Problem: Installation appears stuck during the "Updating conda/mamba" step.
Solution: Press Ctrl+C to cancel, then run with quiet mode to skip housekeeping updates:
python -m pinginstaller <yml_url> -q
Or skip housekeeping by commenting out the install_housekeeping() call temporarily.
Problem: PINGInstaller is using a different conda installation than expected.
Solution:
Verify which conda is active:
which conda # Linux/Mac
where conda # Windows
Check CONDA_PREFIX:
echo $CONDA_PREFIX # Linux/Mac/PowerShell
echo %CONDA_PREFIX% # Windows CMD
Activate the correct conda first, then run pinginstaller from that environment.
Problem: PINGInstaller uses conda even though mamba is installed.
Solution:
Verify mamba is in base environment:
conda activate base
mamba --version
Reinstall mamba if needed:
conda install -n base mamba -y
Check output: PINGInstaller will print "Using mamba for faster installation" if detected.
Problem: Cannot write to conda directories.
Solutions:
Problem: Packages installed but cannot be imported.
Solutions:
Activate the environment first:
conda activate ping
python -c "import pingmapper"
Verify environment location:
conda env list
# Ensure 'ping' environment is listed
Check package installation:
conda list | grep pingmapper
If you encounter issues not covered here:
python -m pinginstaller <yml> --debugFAQs
Light-weight interface for running PING ecosystem (PINGMapper, etc.)
We found that pinginstaller demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.