Security verification of Python "pip" packages?

[futurity]

Hi,

I was wondering if there is any malware checking performed on python packages before they are made available through the "pip" repository, or can anyone upload any code / packages they like?

Sorry for being so paranoid,

Neil

[sparkz_alot]

As far as I know, there are no security measures at the moment (for any repository, for that matter). The best method would be to read the code which, of course, can be impractical. Stick with well known packages, if you have a package with 50,000 downloads and another with 1 download, you'd probably be better served using the first. Running your code in a virtual environment may also afford you some level of protection. Make sure you are installing the "correct" package. There are a number of packages with similar names. So, for example, make sure you install "scipy" and not "scipi".  As with any software, the best security is to be smart and use commonsense. When in doubt, don't!

[metulburr]

i have blindlessly installed packages for years, some not even on pypi, but in butbucket and github and never once looked at their code for malicious content. Some have been very few downloads, and/or unpopular packages. I have never once had a problem.

I must admit though i am on linux and i often reinstall my OS every 6 months or so to get the latest, but also purge all the crap from my system...mostly my own crap i installed/downloaded/modified, etc.

There has never once been an incident that i am aware of with malware in pypi. Thats whats great about open source. There are so many eyes on it, that it most likely would be noticed before too long, then that author would be blacklisted.

[sparkz_alot]

butbucket

Seriously? I would not want to download anything from there 


I should mention, there has been (is?) an ongoing effort towards security using The Update Framework (TUF) see more here: TUF
and Pythons "pip" here: pip and TUF

[futurity]

Thanks for all your responses. Really helpful.

I like sparkz_alot's suggestion of the number of times a package has been downloaded (although I suspect even this could be artificially increased).

Is there an easy way to find out how many times a package has been downloaded (ideally the times it has been installed through the "pip" command)?

[wavic]

I am on Arch Linux most of the time and I don't care about security so much. All my sensitive information like documents or bank accounts are on another Linux system with encrypted partition. 

[snippsat]

Is there an easy way to find out how many times a package has been downloaded (ideally the times it has been installed through the "pip" command)?

pip install vanity
You get a overview of months and year download,with a finish sum.
Example:

vanity requests
requests has been downloaded 103009497 times!
WolframAlpha: 103 million 9 thousand 497

vanity numpy
numpy has been downloaded 13936536 times!
WolframAlpha: 13 million 936 thousand 536

[Larz60+]

There is also a weight value displayed in PyPi when you search on a particular subject.
The higher the number, the more downloads and likes.