pip / PyPI

Python package installer abuse techniques

5 techniques

The setuptools cmdclass parameter allows package authors to override built-in setup commands such as install, develop, egg_info, build_ext, …

Dependency confusion can arise when pip is configured to search both public PyPI and a private index. pip assigns no priority to those …

pip's requirements.txt file format supports global options including --index-url, --extra-index-url, --find-links, and --trusted-host …

When pip installs or builds a package through a legacy setuptools path, it may execute the package's setup.py file using the installing …

Typosquatting on PyPI uses misspellings, character transpositions, or plausible name variations to induce installation of the wrong project. …