Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Report projects that damage other packages, don't adhere to guidelines, or are malicious #3896
What's the problem this feature will solve?
Searching through PyPi I was not able to find anywhere where I can report a project that either contains malicious code or breaks other packages in the repository by overwriting them. To be clear, I am not talking about reporting issues to the project maintainer. This issue is not asking that PyPi duplicate the efforts of github, but as a distributor of software, PyPi needs some mechanism for consumers of the software to flag software that is malicious or may break other software.
I've come across the case of a package that overwrites another package on purpose - not for malicious intent. But that package broke my project, and uninstalling it did not fix it, because it had overwritten the other package. This is bad practice, and there should be a way to report things like this, beyond to the project maintainer. The maintainer may disagree, or may not be maintaining the project anymore.
Malicious projects: Anyone could upload a project that has malicious code buried in it, and unsuspecting developers may install this package thinking that it is "official" because it is on PyPi. There is a little bit of that expectation, since pip is part of the core python package, that packages you install via pip may be more reliable and adhere to certain standards than packages that you may install from github projects. This expectation is obviously unwarranted, but it may exist in some developers nonetheless.
That being said, there should be at least some reliable way to report or flag a project to PyPi maintainers - not the project maintainer - from the project page, and for people to see complaints about a project and judge for themselves, even if the maintainers of PyPi decide not to remove it. I found nothing.
I think there should be one issue on the pypa warehouse github that covers this, because this query has come up in the past, but gets shoved or related to other sub-issues or related issues that are already closed or more complicated.
Describe the solution you'd like
There should be one issue regarding reporting or flagging projects. It should cover these things (possibly as child issues):
For example this dude: https://pypi.org/project/ssh-decorate/#files
Thank you very much @mowshon for being alert, I am shocked I fell a victim to this kind of attack.
I have updated my
Is it possible to automatically identify when pypi packages differ from their github repo, in case this kind of attack occurs again in the future ?