Is setting the pip index enough to avoid accidentally installing the public package

Python Help
1

Let’s say I have some package named mysuperprivatepackage which I intend to host and use inside my private index. My software is allowed to install from this private index and the public index (pypi.org).

Say someone with malicious intent uploads the same name to pypi.org in hopes that our software installs theirs.

Is simply setting pip index (e.g., pip install --index-url) enough to protect against this?

2

Hey Keto the packaging category discussed this… check it out
https://discuss.python.org/t/dependency-notation-including-the-index-url/5659/4