# Improving risks and consequences against typosquatting on pypi **URL:** \ **Category:** Packaging\ **Created:** [August 29, 2020, 1:18pm UTC](https://discuss.python.org/t/improving-risks-and-consequences-against-typosquatting-on-pypi/5090 "2020-08-29T13:18:50Z")\ **Posts on this page:** 1\ **Showing post:** 12
**Author:** ![PoluX](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/polux/32/2602_2.png) [@PoluX](https://discuss.python.org/u/PoluX)\ **Post date:** [January 17, 2021, 2:50pm UTC](https://discuss.python.org/t/improving-risks-and-consequences-against-typosquatting-on-pypi/5090/12 "2021-01-17T14:50:35Z")
> [@sumanah](#): > > Could you be more specific about what caused you to get that impression? Facts: Only one example: the `request` package has been published containing an effective malware. It has been removed few days after (once the malware has been discovered). During this time it has been downloaded a dozen of thousand times. There have been no attempt to log or announce about the flaw on the internet that the package have contained a malware. And it seems that it is not an isolated case. And it is still continuing as is. Impression: After asking [security@python.org](mailto:security@python.org) about the latter, I have been advised to post on this forum, maybe the best place to discuss. It appears finally that there is almost no discussion. I essentially learned that the problem is not new, that this place is not the place to speak about problems, and that I should have filled issues into warehouse. I started this thread with the joy that my bad experience could help to make PyPI better, but actually I leaves it being disappointed. Opinion: I am quite skeptical about the ability of effectively mitigating the risk using automated malware detection (but maybe I am wrong). --- _[View the full topic](https://discuss.python.org/t/improving-risks-and-consequences-against-typosquatting-on-pypi/5090)._