• marcos@lemmy.world
    link
    fedilink
    arrow-up
    37
    ·
    6 days ago

    horses was last released in 2024, and can only run on python up to 3.12.

    horses depends on iron-making, that is up to date. That means the current version of iron-making depends on python >= 3.14, and that all the versions prior to 2025 were taken offline due to a CVE where if you run the library as root in a web backend that uses the make_nail function, people can open your barn doors without authorization when inside it.

    • anewfox@lemmy.zip
      link
      fedilink
      arrow-up
      10
      ·
      6 days ago

      and also the most recent horses release on pypi includes a crypto miner and credential stealer.

    • nibbler@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      1
      ·
      5 days ago

      I’m really having trouble recognizing if @marcos@lemmy.world started talking bullhoreseshit, or if the post by @Diplomjodler@lemmy.world is the first to be just trolling…