A chilling PyPI supply-chain attack turns compromised packages into credential-stealing, self-propagating malware. TinyMongo offers an in-process MongoDB-compatible option, while Jev explores typed model outputs and open alternatives. Plus, a seemingly harmless __dict__ read can permanently slow Python attribute access, and a dungeon crawler makes Python 3.15 features feel like a game.
33:17
forum Ask episode
web_stories AI Snips
view_agenda Chapters
menu_book Books
auto_awesome Transcript
info_circle Episode notes
volunteer_activism ADVICE
Responding To The MemoryOS Supply Chain Attack
Downgrade compromised MemoryOS and OpenClaw versions, then rotate every credential reachable from your home directory.
Kill running sckit processes and inspect repositories for runtime-update.yml workflows or .sckit directories because the malware spreads through stolen tokens.
insights INSIGHT
Import-Time Malware Turns Package Theft Into A Worm
The attack launches a Go implant on import, so avoiding package installation scripts does not prevent compromise.
Sckit steals PyPI, GitHub, SSH, cloud, and environment credentials, then uses them to infect additional repositories and packages.
volunteer_activism ADVICE
Harden CI Pipelines Against Package Hijacking
Harden CI release pipelines because attackers modified GitHub Actions and abused publishing credentials before legitimate releases ran.
Review token access, isolation, and sandboxing rather than assuming the CI platform itself caused the vulnerability.
Get the Snipd Podcast app to discover more snips from this episode
Join us on YouTube at pythonbytes.fm/live to be part of the audience. Usually Tuesday at 7am PT. Older video versions available there too.
Finally, if you want an artisanal, hand-crafted digest of every week of the show notes in email form? Add your name and email to our friends of the show list, we'll never share it.
On Sept 23 an attacker published backdoored MemoryOS 2.0.34 on PyPI and three bad versions (0.1.21, 0.1.23, 0.1.25) of MemTensor's OpenClaw plugin on npm. PyPI had no clean release that day, so 2.0.34 was the newest.
They pushed commits to MemTensor's own GitHub Actions release pipelines. On PyPI that was a custom Poetry build backend, and on npm a tweaked validation script. Both used BASH_ENV to hand the publish token to the attacker before the real publish ran. SafeDep couldn't confirm how the attacker got push access.
Runs on import, not install: A Go implant called sckit starts when the library loads, so --ignore-scripts won't save you.
It harvests credentials from your home directory (npm and PyPI tokens, GitHub tokens, SSH keys, cloud CLI tokens, .env files) and sends them to skyleen[.]fr servers.
It's a worm: It uses stolen tokens to copy itself into other repos and packages, so the victim list could grow.
If you installed it: Downgrade to MemoryOS 2.0.33 (plugin 0.1.20) and rotate every credential reachable from $HOME. Also kill any running sckit stage0 process and check repos you can push to for a stray runtime-update.yml workflow or .sckit/ directory.
Will completely run talkpython.fm after weeks of shared work together (in SQLite mode).
Calvin #3: Jev: what to know
What it is: Jev is a model from TypeSafe AI that answers with typed results (yes/no probabilities, scores, picks from your options) instead of prose. Real Python published a hands-on tutorial on 2026-09-24 and the buzz on hacker news is almost deafening.
It's proprietary: Jev is a hosted, closed-weight model. There are no weights to download and no self-hosting. Everything called "open Jev" is an independent reimplementation, not TypeSafe's model.
Your data leaves your machine: Every call sends your input text to a third-party API. In the tutorial that path goes through OpenRouter to TypeSafe. Think twice before sending customer messages, tickets or anything sensitive.
Cost and stability are open questions: The tutorial calls Jev "cheap, but not free" and says it's fast and cheap "at the moment." It also says whether that stays true is "something to keep an eye on."
Credit to Real Python: It's a good, practical intro. It shows the Noul, Score and Choice primitives, and its point that instruction wording matters more than thresholds is useful advice for any model. The tutorial itself says similar results are possible with a well-prompted LLM.
Open options to look at instead:
JevK5 (https://github.com/allebee/jevk5): Apache-2.0 weights and code, 4B or 9B parameters, and it accepts TypeSafe-style requests.
SemIf, formerly OpenJev (https://github.com/TheoLeeCJ/openjev): MIT-licensed, small models, and it can run CPU-only.
openjev-sglang (https://github.com/ekzhang/openjev-sglang): a Jev-compatible endpoint running Qwen3.6-35B-A3B, but no license is stated, so check before commercial use.
The catch: These copy Jev's interface, not its model or training. Results will differ, and I haven't run any of them. Benchmarks are self-reported, and JevK5 is English-only.
Timofei Ivankov benchmarks a CPython internals surprise: since 3.11, attribute access skips the instance dict entirely. A specialized opcode reads the attri.bute at a fixed byte offset in the object's inline values array. Read obj.__dict__ once, though, and the dict gets materialized, the object loses that specialized path for the rest of its life, and a million-iteration loop goes from 33 ms to 51 ms on CPython 3.14. vars() and copy.copy() trigger the same thing, so a debugging print or a shallow copy in code touching your hot objects quietly makes every later attribute access roughly 1.5x slower.
The slowdown is permanent and nothing about it looks like a performance decision: ordinary code far from the hot loop can trigger it, and the function that gets slower never changes.
Materializing dict produces a split table, and the LOAD_ATTR_WITH_HINT fallback declines split tables, so the object ends up with no specialization at all
vars(), 'x' in o.dict, and copy.copy() all materialize it; copy.copy is the realistic trap since nobody treats a shallow copy as a performance decision
slots instances read attributes at exactly the same speed and cannot fall into the trap since there is no dict to materialize
On the free-threaded build both effects grow: atomic incref on reads plus an object lock on writes push the penalty from 17.6 to 25.4 ns
Credit: this item was surfaced by the PyCoder's Weekly newsletter
Extras
Calvin:
whatsnewt - a TUI text adventure through what's new in Python 3.15; playful but niche.
Python Bytes 
