# Make the list of denied packages on PyPI available to the community **URL:** \ **Category:** Packaging\ **Created:** [June 28, 2021, 6:24am UTC](https://discuss.python.org/t/make-the-list-of-denied-packages-on-pypi-available-to-the-community/9446 "2021-06-28T06:24:12Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![fridex](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/fridex/32/11877_2.png) [@fridex](https://discuss.python.org/u/fridex)\ **Post date:** [June 28, 2021, 6:24am UTC](https://discuss.python.org/t/make-the-list-of-denied-packages-on-pypi-available-to-the-community/9446/1 "2021-06-28T06:24:12Z")
Hi everyone, I would like to ask if there are any plans to make the list of denied packages on PyPI available to the community. If no, is this something to consider? Thanks in advance, Fridolin ---
**Author:** ![steven.daprano](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/steven.daprano/32/1083_2.png) [@steven.daprano](https://discuss.python.org/u/steven.daprano)\ **Post date:** [June 28, 2021, 6:46am UTC](https://discuss.python.org/t/make-the-list-of-denied-packages-on-pypi-available-to-the-community/9446/2 "2021-06-28T06:46:38Z")
Hi Fridolín, What do you mean by denied packages? ---
**Author:** ![encukou](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/encukou/32/2461_2.png) [@encukou](https://discuss.python.org/u/encukou)\ **Post date:** [June 28, 2021, 6:48am UTC](https://discuss.python.org/t/make-the-list-of-denied-packages-on-pypi-available-to-the-community/9446/3 "2021-06-28T06:48:23Z")
I assume the list is private for security reasons. But you might be interested in a subset: the names [reserved for Fedora packages](https://github.com/pypa/pypi-support/issues/355#issue-609431148) (in Details at the bottom of the comment). ---
**Author:** ![dustin](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/dustin/32/149_2.png) [@dustin](https://discuss.python.org/u/dustin)\ **Post date:** [June 28, 2021, 8:18am UTC](https://discuss.python.org/t/make-the-list-of-denied-packages-on-pypi-available-to-the-community/9446/4 "2021-06-28T08:18:01Z")
There are no plans to make the list public, though I’m curious why you ask or what benefit you’re imagining. FYI, I would estimate that the list consists about ~90% spam package names. The prohibitions are mostly reactive and not preemptive, with the exception of cases like what @encukou has already shared. ---
**Author:** ![fridex](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/fridex/32/11877_2.png) [@fridex](https://discuss.python.org/u/fridex)\ **Post date:** [June 28, 2021, 11:10am UTC](https://discuss.python.org/t/make-the-list-of-denied-packages-on-pypi-available-to-the-community/9446/5 "2021-06-28T11:10:20Z")
> [@dustin](#): > > There are no plans to make the list public, though I’m curious why you ask or what benefit you’re imagining. We have two main use-cases on our side: - have a dataset where we could experiment with an automated typosquatting or spam packages detection - as [Thoth](https://discuss.python.org/t/thoth-an-enhanced-server-side-resolution-offered-to-the-python-community/8883) supports cross-index resolution when package indexes are not treated as mirrors but rather separate sources of packages, we would like to make sure package names published on other indexes can be still valid package names on PyPI (besides PEP-423) ---
**Author:** ![fridex](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/fridex/32/11877_2.png) [@fridex](https://discuss.python.org/u/fridex)\ **Post date:** [June 28, 2021, 11:12am UTC](https://discuss.python.org/t/make-the-list-of-denied-packages-on-pypi-available-to-the-community/9446/6 "2021-06-28T11:12:43Z")
> What do you mean by denied packages? Package names that are denied by PyPI - either typo-squatted or [spam packages](https://github.com/pypa/warehouse/issues/9717). ---
**Author:** ![fridex](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/fridex/32/11877_2.png) [@fridex](https://discuss.python.org/u/fridex)\ **Post date:** [June 28, 2021, 11:26am UTC](https://discuss.python.org/t/make-the-list-of-denied-packages-on-pypi-available-to-the-community/9446/7 "2021-06-28T11:26:53Z")
> [@fridex](#): > > - have a dataset where we could experiment with an automated typosquatting or spam packages detection > - as [Thoth](https://discuss.python.org/t/thoth-an-enhanced-server-side-resolution-offered-to-the-python-community/8883) supports cross-index resolution when package indexes are not treated as mirrors but rather separate sources of packages, we would like to make sure package names published on other indexes can be still valid package names on PyPI (besides PEP-423) Another use case for us is a notification of a spotted malicious package on PyPI where users who accidentally installed such a package would be notified with possible security concerns. ---
**Author:** ![dustin](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/dustin/32/149_2.png) [@dustin](https://discuss.python.org/u/dustin)\ **Post date:** [June 28, 2021, 2:36pm UTC](https://discuss.python.org/t/make-the-list-of-denied-packages-on-pypi-available-to-the-community/9446/8 "2021-06-28T14:36:51Z")
> [@fridex](#): > > Another use case for us is a notification of a spotted malicious package on PyPI where users who accidentally installed such a package would be notified with possible security concerns. Just to reiterate: not all package names that have been blocked should be considered malicious – currently we don’t differentiate. Surfacing known-malicious projects that have been taken down is captured in [https://github.com/pypa/warehouse/issues/4703](https://github.com/pypa/warehouse/issues/4703)