❗Bug Report: Unsafe `pip install` with `--break-system-packages` and Hallucinated Package Name

[kvyb]

Description

The AI assistant suggested running a pip install command that includes the --break-system-packages flag on a Homebrew-managed Python environment. The package it recommended (graphifyy) does not appear to exist on PyPI, raising concerns about either a hallucinated package name or a potential typosquatting vector.

Steps to Reproduce

See screenshot from codex, when following readme instructions for setup:

Agent Output

Reason: Do you want to allow installing the 'graphifyy' package so I can build the knowledge graph for this repo?

$ /opt/homebrew/opt/python@3.14/bin/python3.14 -m pip install graphifyy --break-system-packages

Why This Is Problematic

1. --break-system-packages violates PEP 668

Python 3.11+ (and Homebrew's Python distribution) marks the environment as externally managed. The --break-system-packages flag explicitly overrides this safeguard and can:

• Corrupt the global or Homebrew-managed Python environment.
• Create conflicts between pip-installed and Homebrew-installed packages.
• Lead to subtle, hard-to-debug breakage in system tools that depend on Python.

2. graphifyy ❗ appears to be a non-existent or hallucinated package

• A search on PyPI returns no results for graphifyy.
• This could be a hallucinated package name, or worse, a vector for typosquatting, a known supply chain attack where malicious packages are published under names that look like plausible typos of popular packages.
• If a bad actor were to register graphifyy on PyPI, any user who accepted this suggestion would unknowingly install malicious code.

Expected Behavior

1. Respect PEP 668: The agent should never suggest --break-system-packages. If it detects an externally managed environment, it should stop and take the appropriate corrective action.
2. Use virtual environments: The agent should automatically create and activate a virtual environment before installing anything:

   python3 -m venv .venv
   source .venv/bin/activate
   pip install <package>

3. Verify packages before suggesting installation: The agent should confirm that a package actually exists on PyPI (and is spelled correctly) before prompting the user to install it. This is a basic safeguard against hallucinated names and supply chain attacks.

Environment

• Python: 3.14 (Homebrew, /opt/homebrew/opt/python@3.14/)
• OS: macOS (Apple Silicon)
• Environment type: Externally managed (PEP 668)

Severity

High: This combines two serious issues: potential corruption of the user's Python environment and a possible supply chain attack vector via a hallucinated package name. Either one alone would be worth flagging; together they represent a meaningful safety gap.

[safishamsi]

Thanks for the detailed report. A couple of clarifications and one real fix.

graphifyy is a real package

It has been on PyPI since April 3rd: https://pypi.org/project/graphifyy/

The double-y is intentional while the single-y name is being reclaimed. The README explains this. It is not hallucinated and not a typosquatting risk since we own and publish it.

The --break-system-packages concern is valid

You are right that blindly appending --break-system-packages on a Homebrew Python environment is risky. The flag was there as a fallback for PEP 668 managed environments but the current code applies it unconditionally without trying a clean install first. We are fixing the skill to try a plain pip install first and only fall back to --break-system-packages if that fails, which is the correct behaviour. This will go out in the next release.

The screenshot

The agent output in your screenshot is correct behaviour from the skill. The install line it ran is what we shipped. The fix addresses the flag ordering, not the package name.

[safishamsi]

Fixed in v0.3.19. The skill now tries a plain pip install first and only falls back to --break-system-packages if that fails. Homebrew and other PEP 668 managed environments will go through the clean path in the vast majority of cases and never see the flag. On graphifyy being real: it has been on PyPI since April 3rd at https://pypi.org/project/graphifyy/ — the double-y is intentional while the graphify name is being reclaimed.