{"action":"created","issue":{"url":"https://api.github.com/repos/pypa/pip/issues/5777","repository_url":"https://api.github.com/repos/pypa/pip","labels_url":"https://api.github.com/repos/pypa/pip/issues/5777/labels{/name}","comments_url":"https://api.github.com/repos/pypa/pip/issues/5777/comments","events_url":"https://api.github.com/repos/pypa/pip/issues/5777/events","html_url":"https://github.com/pypa/pip/issues/5777","id":359528338,"node_id":"MDU6SXNzdWUzNTk1MjgzMzg=","number":5777,"title":"Feature request: Automatically uninstall malicious packages taken down from PyPI","user":{"login":"di","id":294415,"node_id":"MDQ6VXNlcjI5NDQxNQ==","avatar_url":"https://avatars1.githubusercontent.com/u/294415?v=4","gravatar_id":"","url":"https://api.github.com/users/di","html_url":"https://github.com/di","followers_url":"https://api.github.com/users/di/followers","following_url":"https://api.github.com/users/di/following{/other_user}","gists_url":"https://api.github.com/users/di/gists{/gist_id}","starred_url":"https://api.github.com/users/di/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/di/subscriptions","organizations_url":"https://api.github.com/users/di/orgs","repos_url":"https://api.github.com/users/di/repos","events_url":"https://api.github.com/users/di/events{/privacy}","received_events_url":"https://api.github.com/users/di/received_events","type":"User","site_admin":false},"labels":[{"id":729243948,"node_id":"MDU6TGFiZWw3MjkyNDM5NDg=","url":"https://api.github.com/repos/pypa/pip/labels/T:%20feature%20request","name":"T: feature request","color":"f4e23d","default":false},{"id":27935675,"node_id":"MDU6TGFiZWwyNzkzNTY3NQ==","url":"https://api.github.com/repos/pypa/pip/labels/T:%20security","name":"T: security","color":"CC0000","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-09-12T15:13:18Z","updated_at":"2018-09-18T21:16:47Z","closed_at":null,"author_association":"MEMBER","body":"**What's the problem this feature will solve?**\r\nPyPI occasionally gets malicious packages uploaded to it. PyPI administrators remove the packages as quickly as possible, but sometimes users still install these packages before they are taken down, and the packages remain in the user's environment.\r\n\r\n**Describe the solution you'd like**\r\nAt runtime, `pip` queries PyPI for a list of malicious packages that have been taken down from PyPI:\r\n* if it doesn't find any of them in the local environment, it does nothing;\r\n* if it finds a malicious package has been installed, it uninstalls it automatically.\r\n\r\n**Additional context**\r\nThe necessary API doesn't currently exist on PyPI, but if this feature is accepted, it would be trivial to implement."},"comment":{"url":"https://api.github.com/repos/pypa/pip/issues/comments/422558519","html_url":"https://github.com/pypa/pip/issues/5777#issuecomment-422558519","issue_url":"https://api.github.com/repos/pypa/pip/issues/5777","id":422558519,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMjU1ODUxOQ==","user":{"login":"di","id":294415,"node_id":"MDQ6VXNlcjI5NDQxNQ==","avatar_url":"https://avatars1.githubusercontent.com/u/294415?v=4","gravatar_id":"","url":"https://api.github.com/users/di","html_url":"https://github.com/di","followers_url":"https://api.github.com/users/di/followers","following_url":"https://api.github.com/users/di/following{/other_user}","gists_url":"https://api.github.com/users/di/gists{/gist_id}","starred_url":"https://api.github.com/users/di/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/di/subscriptions","organizations_url":"https://api.github.com/users/di/orgs","repos_url":"https://api.github.com/users/di/repos","events_url":"https://api.github.com/users/di/events{/privacy}","received_events_url":"https://api.github.com/users/di/received_events","type":"User","site_admin":false},"created_at":"2018-09-18T21:16:47Z","updated_at":"2018-09-18T21:16:47Z","author_association":"MEMBER","body":"Answers:\r\n\r\n> 1. Once a malicious package has been removed from PyPI, is that name forever flagged as bad?\r\n\r\nYes.\r\n\r\n> 2. Or can it be at some point flagged as safe? A use case could be a typo-squatted name is given to the rightful owner.\r\n\r\nNope, it is permanently unavailable. We don't release typo squats to the \"proper\" owners. It would be a pain to manage 1 real package plus 5-10 typos of the name simultaneously. It's easier if the typo just never works.\r\n\r\n> 3. If it is marked as safe, would pip then stop asking to uninstall?\r\n\r\nThey won't be marked as \"safe\".\r\n\r\n> 4. And how about if the user had installed the malicious version, but now the name is marked good, would pip uninstall the bad one?\r\n\r\nSee above."}}
{"actor":{"display_login":"di"}}