PyPI Blog: Project Quarantine

Its always an interesting dynamic: assuming a high trust society pays dividends - Python would be nowhere close the success it has been without PyPI.<p>But then success attracts trust abusers and forces raising the fences (which comes with higher costs, both direct and indirect).<p>Direct costs in the people and infrastructure that must be dedicated to the task. Indirect costs in the frictions generated by complicating workflows.<p>It all points to the need for open source ecosystems to be taken more seriously by the economically able users who most benefit from this amazing development.

&gt; The one project cleared was a project containing obfuscated code, in violation of the PyPI Acceptable Use Policy.<p>Interesting, I didn’t know that. While I haven’t released anything obfuscated on PyPI, I’ve certainly written Python projects that include obfuscated code by necessity, namely scrapers packing duktape (embedded JS interpreter) and third party obfuscated JS blobs to generate signatures and stuff. I know for a fact there are projects like that on PyPI. I wonder if those are allowed.<p>(Come to think of it, those probably can be DMCAed if the targeted service provider is sufficiently motivated.)

The still don&#x27;t even have a way to avoid dependency confusion attacks when using private package repos (other than also registering every single private package name you use on pypi.org). Blows my mind.

Awesome work, kudos to the PyPI team. Will it be possible to receive notifications of projects quarantine as a member of the public?

Given how widespread PyPI usage is, I&#x27;m surprised they only have one full time security staff. I mean I guess it makes sense, usage doesn&#x27;t always mean they get more donations&#x2F;money, but damn.

the fact that `pip install` just runs whatever is in `setup.py` is still mind baffling, even if the author weren&#x27;t mallicious the `setup.py` can still do harm (say delete a file by mistake), there really needs to be an official way of sandbox its running.

<a href="https:&#x2F;&#x2F;socket.dev&#x2F;" rel="nofollow">https:&#x2F;&#x2F;socket.dev&#x2F;</a> does a good job in detecting malicious packages in npm.<p>In their FAQ[1], they mention that they have plans to expand to PyPI as well.<p>[1]: <a href="https:&#x2F;&#x2F;docs.socket.dev&#x2F;docs&#x2F;faq" rel="nofollow">https:&#x2F;&#x2F;docs.socket.dev&#x2F;docs&#x2F;faq</a>

Quarantining projects is just a band-aid. If you’re worried about malware, maybe stop letting random people upload code to the official package index. Or just write better docs so people stop using random packages in the first place.

I see some comments about the lack of security of Pypi. And they are totally right, I’m also concerned. But to be fair, many other languages don’t fare better in that arena. I don’t want to give examples, but everyone knows horror histories with other languages.<p>Again, is not that because others are worse, is ok, but I would cut a little slack. Specially for the fact that having all packages somehow signed&#x2F;audited would be a titanic task. And I guess I’m not willing to pay for it.