PEP 541 Request: newrelic-lambda

[TimPansino]

Project to be claimed

newrelic-lambda: https://pypi.org/project/newrelic-lambda

Your PyPI username

newrelic: https://pypi.org/user/newrelic

Reasons for the request

This project is an official New Relic package, which was maintained by mwhelan_newrelic on PyPi. He is no longer an employee of New Relic and his account is likely unrecoverable, as the email account likely associated with it was deleted. The project has not seen maintenance since 2020.

Would like to transfer control to the official New Relic account both for security reasons (preventing malicious releases) and to potentially provide a maintenance update.

Maintenance or replacement?

Maintenance

Source code repositories URLs

Source control is currently on New Relic's GitHub Enterprise instance, may be released publicly on GitHub in the future on newrelic/newrelic-lambda-python or a similar name.

Contact and additional research

Sent a message to the original maintainer over LinkedIn and awaiting a response. Expecting a dead end on credentials to a 4 year old unused PyPi account, especially one where the associated email is likely long since deleted.

Code of Conduct

• I agree to follow the PSF Code of Conduct

[TimPansino]

@di Any chance you could support on this request? We're a bit antsy over this being a potential vulnerability and we haven't seen any tracktion in ~3 months.

[Thespi-Brain]

Hi @TimPansino,

Since the original owner of the project is no longer with the company, and the project that they were maintaining is part of the official New Relic packages, perhaps going through an account recovery request, rather than a PEP 541 request might be helpful since you mentioned that @mwhelan_newrelic's email account is no longer valid. We can switch it over for a neutral company email for New Relic and then you can transfer ownership yourself. Let us know how you would like to proceed, thanks.

[TimPansino]

Hi @Thespi-Brain

A good neutral email for us is Python@newrelic.com, which is in use. If the warehouse supports emails with + signs in them, could we set it to Python+mwhelan@newrelic.com?

I believe there's also still 2 factor auth enabled on his old account, as we had IT try resurrecting his email and recovering it but the 2FA blocked us there as well. Can you reset that by chance at the same time?

[Thespi-Brain]

Hi @TimPansino,

Yes, I believe we do support emails with a "+" sign. I highly recommend opening a separate account recovery issue and requesting the email update change there. You can open an account recovery request here.

[TimPansino]

Package was successfully transferred following the account recovery in #6484.