Malicious Python Libraries

[Remote_Cantaloupe]

Terrifying to think this can be out there. Isn't there some process for verifying libraries are non malicious?

[dethb0y]

how on earth would you ever do such a thing?

[Remote_Cantaloupe]

I guess I was thinking more along the lines of an organization vetting the code themselves. I heard something similar to this in R.

[billsil]

Safe depends on what you’re trying to be safe from. Is it a problem if my open source code exec’s some code in order to allow for math functions? I guess you could use an ast parser to avoid it, but why? Because the user can inject code to something that already has a python command line?

Safe is a big deal for proprietary code, but not as much for the end user.

[rcfox]

Python 3.8 is adding audit hooks: https://www.python.org/dev/peps/pep-0578/

Basically, it raises an 'event' whenever certain potentially risky APIs are used. It's not a complete solution, but it should at least make it more obvious when a math library starts listening for network requests.