PyPi Typo-squatting: Is there any mechanism to delay new package name visibility?

[bschubert (Brian Schubert)]

Some related threads:

Namespace support in pypi

Elaborating on an idea initially surfaced in the Packaging Summit 2019 ideas thread and also mentioned at some point on the warehouse github site, this thread is intended to capture thoughts on work needed to implement namespaces on pypi. I expect this could ultimately need discussed more broadly on relevant mailing lists. As someone that’s new to the PyPA ecosystem I’m totally open to suggestions about where best to communicate these ideas for feedback. The basic idea is to implement support …

"too similar" error with namespace project

I am developing a library and want to release it on PyPI. It worked fine when I published part of the project under the name ‘pygim-common,’ but when I tried to release the ‘master’ project as ‘pygim,’ it failed because the names are too similar. Background: I intend to use ‘pygim’ as the entry point for all other projects and ‘pygim-common’ as the main shared package with all other namespace projects. I understand that ‘pygim’ and ‘pygim-common’ have some similarities in their names, but how …

Improving risks and consequences against typosquatting on pypi

[disclaimer: I write better in french than globish.] [disclaimer: forum’s stupidity force me to break most links.] Hi, Some facts first I have recently been powned due to a typo in package name (request instead of requests). I wrote my story here (in french) : https://metrodore.fr/i-have-been-powned.html There is no CVE, no public statement about the malware. It is not found in publicly available database. The trojan stayed on my machine during ~20 days after it was removed by the pypi admi…

PyPI as a Project repository vs. Name registry (a.k.a. PyPI namesquatting, e.g. for Fedora packages)

Hello, As PyPI has become the de-facto canonical namespace for freely redistributable Python packages, I would like to encourage maintainers of packages in the Fedora Linux distro to synchronize their Distribution Package names with PyPI – effectively, to merge Fedora’s namespace into PyPI’s. This has not yet been discussed in Fedora; I’m kicking off the discussion there as well. Here, I’d like to discuss the PyPI side of things. While this discussion is ongoing, the names that Fedora uses bu…