Python Pip Dependency Confusion
Overview
Similar to npm dependency confusion, attackers can publish packages with internal names to PyPI. When pip searches for a package, public PyPI is checked and a higher version number wins over private index entries.
Remediation
- Use
--index-urlpointing to private registry with--extra-index-urlfor PyPI fallback - Use
--no-indexwith--find-linksfor air-gapped installs - Add package to PyPI placeholder to prevent namespace hijacking