# I am facing Security blocking PyPi.org how to fix it

**URL:** <https://discuss.python.org/t/i-am-facing-security-blocking-pypi-org-how-to-fix-it/22601>\
**Category:** Python Help\
**Tags:** help\
**Created:** [January 10, 2023, 3:41pm UTC](https://discuss.python.org/t/i-am-facing-security-blocking-pypi-org-how-to-fix-it/22601 "2023-01-10T15:41:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hannan011](https://avatars.discourse-cdn.com/v4/letter/h/bc79bd/32.png) [@hannan011](https://discuss.python.org/u/hannan011)\
**Post date:** [January 10, 2023, 3:41pm UTC](https://discuss.python.org/t/i-am-facing-security-blocking-pypi-org-how-to-fix-it/22601/1 "2023-01-10T15:41:14Z")

</div>

It was suggested that I ask this here, and if I’m asking it in the incorrect area, I apologise in advance.

Worst issue The past two weeks, I encountered. When downloading modules using pip at work, I started experiencing problems.  
There were issues verifying the SSL certificate for HTTPSConnectionPool(host=‘[pypi.org](http://pypi.org)’, port=443), and I would receive a succession of WARNING messages indicating that this had occurred.

After some time, I learned that the security director at this company had blocked pypi on the Umbrella (Cisco’s OpenDNS) because the site had "29 malwared dangerous modules["](https://alightmotionapps.com). That was from last fall, as far as I can tell, and all those modules have been taken out.

What can I do to rectify this, I wonder?  
Waiting for reply  
Thanks:

---

<div class="post-metadata">

**Author:** ![sinoroc](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sinoroc/32/1607_2.png) [@sinoroc](https://discuss.python.org/u/sinoroc)\
**Post date:** [January 10, 2023, 4:29pm UTC](https://discuss.python.org/t/i-am-facing-security-blocking-pypi-org-how-to-fix-it/22601/2 "2023-01-10T16:29:01Z")

</div>

Probably related:

- [How to handle Security blocking PyPi.org](https://discuss.python.org/t/how-to-handle-security-blocking-pypi-org/22493)

---

<div class="post-metadata">

**Author:** ![kgraham](https://avatars.discourse-cdn.com/v4/letter/k/e68b1a/32.png) [@kgraham](https://discuss.python.org/u/kgraham)\
**Post date:** [January 10, 2023, 5:05pm UTC](https://discuss.python.org/t/i-am-facing-security-blocking-pypi-org-how-to-fix-it/22601/3 "2023-01-10T17:05:51Z")

</div>

That’s my original post. 🙂  
Thanks!

---

<div class="post-metadata">

**Author:** ![barry-scott](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@barry-scott](https://discuss.python.org/u/barry-scott)\
**Post date:** [January 10, 2023, 7:49pm UTC](https://discuss.python.org/t/i-am-facing-security-blocking-pypi-org-how-to-fix-it/22601/4 "2023-01-10T19:49:00Z")

</div>

At work we get the source of the packages, review the code, and then build it in house.  
We find the upstream repos that the PyPI package is built from and download from there.  
It is not unknown for the code in the wheel to not match upstream releases.  
Also knowing the upstream repos makes it possible contribute fixes you need back as PRs.

That is a process that your security people should be able to embrace.