Python Pip Dependency Confusion

Detects Python package configurations vulnerable to dependency confusion attacks through PyPI.

zakirkun 835c91c 2 files · 1.8 KB Updated

File contents

Python Pip Dependency Confusion

Overview

Similar to npm dependency confusion, attackers can publish packages with internal names to PyPI. When pip searches for a package, public PyPI is checked and a higher version number wins over private index entries.

Remediation

  • Use --index-url pointing to private registry with --extra-index-url for PyPI fallback
  • Use --no-index with --find-links for air-gapped installs
  • Add package to PyPI placeholder to prevent namespace hijacking

zakirkun/ice-tea/tree/main/skills/supply-chain/pip-dependency-confusion commit 835c91c989

Frequently asked questions

npx skillmds@latest add zakirkun/python-pip-dependency-confusion