# Python Pip Dependency Confusion

> Detects Python package configurations vulnerable to dependency confusion attacks through PyPI.

- Skill: `zakirkun/python-pip-dependency-confusion` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/python-pip-dependency-confusion`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/python-pip-dependency-confusion/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/python-pip-dependency-confusion

---


# Python Pip Dependency Confusion

## Overview
Similar to npm dependency confusion, attackers can publish packages with internal names to PyPI. When `pip` searches for a package, public PyPI is checked and a higher version number wins over private index entries.

## Remediation
- Use `--index-url` pointing to private registry with `--extra-index-url` for PyPI fallback
- Use `--no-index` with `--find-links` for air-gapped installs
- Add package to PyPI placeholder to prevent namespace hijacking