Hacker News Reader

Downloading a Python package (as done by scrapers, mirrors and security analysts) does not run setup.py. Only if the module is installed is this run.

It's analagous to downloading vs. running an executable.

View on HN

Doing a pip install actually runs the setup.py of the package for source dist, which means running an executable.

It's not the case for wheels though, so you can protect yourself by restricting to binary : --only-binary.

Also doing a pip download is not sensible to this issue, but most people do pip install

Ah, sure. Just making the distinction that you don't have to actually use a module within your code. That installing the module, even if you never use it in your own code, runs some of the code in that module.

Reply on news.ycombinator.com