Artem Golubin: Python's binary wheels and supply chain attacks

Wait 5 sec.

Python is known for fast packages despite being a slow language.The fastest Python packages are written in compiled languages such as C, C++, or Rust,with Python acting only as a glue.Python users usually don't even notice that, because PyPI (Python's package index) providesprecompiled binaries.They are called wheels, and when you run pip install, it prefers them over the source distribution.For example, each release of my packages ships up to 90 different wheels.You need a separate binary wheel for each Python version, platform, and architecturecombination. The regular distribution only contains the source code.Without Python wheels, the distribution would be much harder. When wheels are not available,a user has to compile the code when installing a package.That requires the correct compiler and system dependencies.Since I've spent quite a while analyzing malicious packages on PyPI, this got me thinking about wheels.[......]