Two malicious Python libraries caught stealing SSH and GPG keys (ZDNet)

Not explicitly, obviously. But implied every time this comes up. It's usually claimed that the problem is the programming language *and* *not* certain code written in it.

> the example at hand illustrates that deliberately introducing malicious functionality to an otherwise innocuous software package
> works regardless of the programming language used. IOW, if you want to be secure against this type of attack, “a more restrictive
> runtime environment than what a typical C implementation provides”

That was supposed to be the point: There are a lot of way to cause damage via software and focussing on programming language implementations[*] will not necessarily avoid "damage".

[*] There's actually nothing which would stop a conforming C implementation from doing array bounds checking, at least not theoretically: The C standard leaves the behaviour of out-of-bounds accesses undefined, hence, terminating a program via some signal in case of one would be perfectly acceptable. It's just the C implementations don't do that because "enable a user to implement his own memory management" is a C feature. The obvjous drawback of that is that users have to care more about memory management than when using a more restrictive language (in this respect), which probably isn't worth it on 'current' hardware in a lot of cases.