# Typosquatting, dependency confusion, supply chain attack, call it as you wish

**URL:** <https://discuss.python.org/t/typosquatting-dependency-confusion-supply-chain-attack-call-it-as-you-wish/52615>\
**Category:** Packaging\
**Tags:** security\
**Created:** [May 4, 2024, 10:49pm UTC](https://discuss.python.org/t/typosquatting-dependency-confusion-supply-chain-attack-call-it-as-you-wish/52615 "2024-05-04T22:49:54Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![sinoroc](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/sinoroc/32/1607_2.png) [@sinoroc](https://discuss.python.org/u/sinoroc)\
**Post date:** [May 5, 2024, 9:19am UTC](https://discuss.python.org/t/typosquatting-dependency-confusion-supply-chain-attack-call-it-as-you-wish/52615/4 "2024-05-05T09:19:58Z")

</div>

Complex topic.

Some random notes from me.

> [@Tansu.KAYRAK](#):
>
> In the meantime what shall we do to avoid our company network being compromised by a new intern that is unaware of this threat like I was (or even by my own human weaknesses) : block PyPi by our firewall maybe ? setup some whitelisted PyPi packages mechanism ?

Yes, hosting your own server or mirror or proxy is a viable solution:

- [Hosting - Python Packaging User Guide](https://packaging.python.org/en/latest/guides/section-hosting/)

Seems like there are commercial solutions available with curated packages (at least that is what I understood from the descriptions, not endorsement from me):

- [https://cloud.google.com/security/products/assured-open-source-software](https://cloud.google.com/security/products/assured-open-source-software)
- [Try ActiveState's Open Source Language Automation Platform](https://www.activestate.com/products/platform/)
- [https://www.anaconda.com/](https://www.anaconda.com/)

There are some tools you could add to your infrastructure (CI/CD pipelines for example), just to name a few:

- [safety · PyPI](https://pypi.org/project/safety/)
- [bandit · PyPI](https://pypi.org/project/bandit/)

As far as I can tell, the major code forges (GitHub, GitLab) have built-in tools and tooling to warn against potential security issues in your code:

- [Code security documentation - GitHub Docs](https://docs.github.com/en/code-security)
- [Secure your application | GitLab](https://docs.gitlab.com/ee/user/application_security/secure_your_application.html)

There is (was) a proposal to strengthen Python packaging ecosystem against “dependency confusion attacks”:

- [PEP 708 – Extending the Repository API to Mitigate Dependency Confusion Attacks | peps.python.org](https://peps.python.org/pep-0708/)
- [PEP 708 - Extending the Repository API to Mitigate Dependency Confusion Attacks](https://discuss.python.org/t/pep-708-extending-the-repository-api-to-mitigate-dependency-confusion-attacks/24179)

---

_[View the full topic](https://discuss.python.org/t/typosquatting-dependency-confusion-supply-chain-attack-call-it-as-you-wish/52615)._