Hacker News Reader

Comment by rantanplan | Hacker News Reader

The regex they have for identifying fake/harmful packages is wrong.

This incorrectly lists `urllib3` or the `cryptography` package for example, which are perfectly valid packages.

[UPDATE]

Read "tobltobs" comment below. I incorrectly removed a trailing space from the regex.

View on HN

Not for me. There is space at the end between the closing bracket and the apostrophe. Maybe you did remove this space when you corrected the smart apostrophes.

You're right. It seems I did remove the space. When I put it back in it doesn't print anything.

Conda users: Here's a script that runs this check against each environment:

https://gist.github.com/osteele/198b50a2a208e5bc7e5fb8d010cf...

I believe urllib3 is built-in. So if you have installed it from PyPI you've gotten a malicious version.

urllib and urllib2 are built-in for Python 2, and were merged and reorganized as just urllib in Python 3. urllib3 is a third-party module.

This is correct. In general, though, most packages don't rely on urllib3 directly, but on `requests`, which uses urllib3 but provides a friendlier API and built-in SSL cert verification.

It's not generally true that built-in packages which also appear on PyPI are malicious.

Many batteries-included packages are also maintained outside of CPython. This is because: (1) in many cases they existed outside prior to being included in CPython, (2) they can experiment with new features before they're included in the CPython version of their package.

https://pypi.python.org/pypi/urllib3

xml should be added to this list.

https://pypkg.com/pypi/xml/f/setup.py

When running that command, I get output like this:

  grep: alabaster: No such file or directory
  grep: appdirs: No such file or directory
  grep: arandr: No such file or directory

for dozens and dozens of packages. Are those errors benign?

No, jastr's command is wrong.

Whoops, remove the xargs

Reply on news.ycombinator.com