New answers tagged


There are two threat models here: Malicious developer uploading malicious packages Malicious attacker uploading malicious packages that belongs to legitimate developers PyPI does not make any attempt to try to resolve #1. Auditing code before installs and only installing packages from reputable developers are the only "protection" you have against these. ...

Top 50 recent answers are included