Hey, not totally sure this is the right place so apologies if not, happy to be pointed elsewhere.
My PyPI project zhmiscellanylite (and my account) got quarantined on Aug 4, I’m pretty sure by automated malware scanning, and honestly I get why. In a release I made the dumb mistake of shipping my code-obfuscator utility in self-obfuscated form, which left a zlib+base64 blob that gets decoded and exec’d. That looks exactly like a malware dropper. It isn’t actually malicious (it’s a code obfuscator, so all it does is take a string and return another string, no network, no filesystem, no system access), but I completely understand why it tripped the scanner.
I’ve already fully remediated it: the exec/blob is gone, replaced with the plain readable source, public here:
I emailed security@pypi .org on Aug 6 and followed up on Sep 30. The only response was an out-of-office auto-reply back in August. It’s been about 2 months now and it’s still quarantined.
I know it’s a small team so I’m really not trying to rush anyone, I’d just hugely appreciate if an admin could take a look, or tell me the right next step or anything else you need from me. Thank you!