pip / PyPI

Python package installer abuse techniques

5 techniques

The setuptools cmdclass parameter allows package authors to override built-in setup commands such as install, develop, egg_info, build_ext, …

Dependency confusion exploits pip's default package resolution behavior, where it searches the public PyPI index alongside or before …

pip's requirements.txt file format supports global options including --index-url, --extra-index-url, --find-links, and --trusted-host …

When a package is installed via `pip install`, pip executes the package's setup.py file using the installing user's privileges. This allows …

Typosquatting on PyPI involves registering package names that are deliberate misspellings, character transpositions, or plausible variations …