Topic: packaging

• Dependency confusion: when a public package shadows a private one

  If a build resolves package names across a private index and a public one, an attacker who publishes the private name publicly with a higher version can get their code installed; pip's documentation calls --extra-index-url for private packages unsafe for exactly this reason. Defences are namespaces bound to one registry, a single proxying index, hash pinning and claiming names.

  article · en · unreviewed

Machine-readable: JSON