Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [pip]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
2 answers
190 views

Python: Does pip install allow escalation of privileges, e.g. through setuid?

I've read that pip install foo allows the developers of foo to run arbitrary code on my machine. I don't mind, as long as I can use Linux user permissions to sandbox it. However, I worry that maybe ...
David Knipe's user avatar
0 votes
1 answer
287 views

Does pip-audit just search requirements.txt for known CVEs?

When looking for a way to shrink the attack surface for pypi package-typo-squatting, I came across a package called pip-audit on an article on the RedHat blog. I attempted to use it, but I'm quite ...
leeand00's user avatar
  • 1,441
0 votes
1 answer
169 views

Is this python package safe? I wrongly executed it with admin privileges and would like to know what steps to take to ensure my computer/data is safe

Before anything, please excuse my clear confusion over what is probably a non-issue. Computer security is definitely not my expertise, so any and all help is appreciated. I recently installed a Python ...
rare-quorum's user avatar
0 votes
0 answers
373 views

How do you lock down PyPI access?

Another question (Is it possible to block non-PyPI requests during pip install?) asked about locking down non-PyPI pip installs for security reasons. This doesn't deal with the problem of malicious ...
Compholio's user avatar
  • 101
14 votes
3 answers
3k views

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
Michael Altfield's user avatar
2 votes
1 answer
342 views

How can the validity and safety of a software library be checked?

So beyond looking at the source code for particular software library, is there a way to vet that it does not contain malicious code? As far as I know from my own research, services like pip, npm, and ...
Rehket's user avatar
  • 23
3 votes
2 answers
623 views

Is it possible to block non-PyPI requests during pip install?

In 2017 and 2018 there were these infamous stories about malicious packages being uploaded to the PyPI (Python Package Index) which tried to do all sorts of things (collecting and sending data, ...
alecxe's user avatar
  • 1,605