The list is in the advisory. Check if you have installed any of these:

  – acqusition (uploaded 2017-06-03 01:58:01, impersonates acquisition)
  – apidev-coop (uploaded 2017-06-03 05:16:08, impersonates apidev-coop_cms)
  – bzip (uploaded 2017-06-04 07:08:05, impersonates bz2file)
  – crypt (uploaded 2017-06-03 08:03:14, impersonates crypto)
  – django-server (uploaded 2017-06-02 08:22:23, impersonates django-server-guardian-api)
  – pwd (uploaded 2017-06-02 13:12:33, impersonates pwdhash)
  – setup-tools (uploaded 2017-06-02 08:54:44, impersonates setuptools)
  – telnet (uploaded 2017-06-02 15:35:05, impersonates telnetsrvlib)
  – urlib3 (uploaded 2017-06-02 07:09:29, impersonates urllib3)
  – urllib (uploaded 2017-06-02 07:03:37, impersonates urllib3)

The advisory has a regex, but it's not formatted well for copy-paste (non-ASCII quotes!). Here's a version that works:

    pip list –format=legacy | egrep ‘^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) ‘

There are many tools that can scan your dependencies and tell you if anything is off. Here's one for reference (cannot vouch for it though as I have not used it):

https://github.com/jeremylong/DependencyCheck/blob/master/RE...

I was wondering the same thing.. and why isn't there a list of package names included in this article?