1

Knowing that some pypi packages have a history of being malicious, like libpeshnx, libpesh, and libari.

Is there some website/service that labels packages as secure or not? for example: node's npm advisores https://www.npmjs.com/advisories

if not, why such service does not exist at this point?

2

If a package has been discovered to be malicious, it will be taken down. The npm advisories link for malicious npm packages is mostly a history if you're looking at packages to download. There isn't a need for a service to tell you whether a package you're about to download is malicious (because it would not exist).

On the other hand, when looking at currently installed packages, in npm, there's a built in feature, npm audit, which will tell you if the packages you're using have vulnerabilities (including known malicious packages). This is actually a newish feature, only released in the past year.

It appears this isn't built in to PIP, but there's a well known package called safety: https://pypi.org/project/safety/ that achieves the same functionality. It looks like this achieves your goals?

  • Thanks for the answer, Yes, this is exactly what i was hoping for. – llpinokio Oct 12 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.