Use of PyPI as a generic storage platform for binaries

I’ve expressed concern in the past with distributing lightweight Python package wrappers around Javascript libraries too. Some people find it a convenient way to indicate JS dependencies in their Python projects and get them installed automatically. The biggest risk that I’m concerned about for any of these cases though is security updates.

The people maintaining Python package wrappers are often not the same people maintaining the upstream non-Python projects, so if they disappear and stop updating the wrapper packages then users who relied those are left in the lurch and may not realize they’re running outdated copies full of known exploitable vulnerabilities (which already happens today with some of the wrapped JS libs).

5 Likes