List of Previously Submitted Malicious Packages?

CAM-Gerlach · May 23, 2023, 10:30pm

Welcome to the Python Discourse! Just FYI, don’t forget to search for previous threads, and make sure your post is in the right category

This has been requested before, e.g.

There is an open issue to do this…

github.com/pypi/warehouse

Publish a list of malicious packages that have been taken down

opened 03:42PM - 12 Sep 18 UTC

di

feature request needs discussion APIs/feeds

**What's the problem this feature will solve?** Users who may have possibly ins…talled malicious packages don't have insight into what packages have been taken down by PyPI administrators. **Describe the solution you'd like** PyPI should publish both a human-readable and machine-readable (API) list of malicious packages that have been taken down. Ideally the human-readable list would be sortable by package name, or by the date it was created/taken down. **Additional context** Feature request to automatically uninstall packages via this API in `pip`: https://github.com/pypa/pip/issues/5777

Which then evolved into this proposed approach for handling it:

Topic		Replies	Views
Make the list of denied packages on PyPI available to the community Packaging	7	1039	June 28, 2021
Checking if a package name is allowed or forbidden/reserved on PyPI Packaging	4	2661	May 21, 2021
An index for deleted PyPI packages / versions Packaging	10	655	April 15, 2024
Improving risks and consequences against typosquatting on pypi Packaging	11	4564	January 17, 2021
Proposing a community maintained database of PyPI package vulnerabilities Packaging	22	6753	June 14, 2021

List of Previously Submitted Malicious Packages?

Related Topics