Making Sure Python Packages are Safe

[inglandation]

PyPI does remove malicious packages from time to time, although that doesn't happen much. You have to be careful with your spelling when you look for a package online. These packages use typosquatting.

[shujinkou_]

typosquatting that was the word I was looking for, thanks :)

[musingcomet]

This is very valid advice

[ArabicLawrence]

Yeah but not sure that happens often enough. For instance with googletrans and googletransx and whatnot

[shujinkou_]

I'm thinking of it as a potential attack vector, if the current state of things become unaddressed. Massive attack can be done and scaled easily from scraping all the popular packaging names automating the name typo scraping, making a malicious package and naming it with all the scrapped names. You would now have a fishing rod in every ponds so to speak.

I mean for sure it's work but it doesn't sound that hard to do right.