Python Pip Dependency Confusion

Detects Python package configurations vulnerable to dependency confusion attacks through PyPI.

zakirkun Updated

File contents

Python Pip Dependency Confusion

Overview

Similar to npm dependency confusion, attackers can publish packages with internal names to PyPI. When pip searches for a package, public PyPI is checked and a higher version number wins over private index entries.

Remediation

  • Use --index-url pointing to private registry with --extra-index-url for PyPI fallback
  • Use --no-index with --find-links for air-gapped installs
  • Add package to PyPI placeholder to prevent namespace hijacking

zakirkun/ice-tea/tree/main/skills/supply-chain/pip-dependency-confusion commit 835c91c989

Frequently asked questions

npx skillmds@latest add zakirkun/python-pip-dependency-confusion