Collaborate Disseminate
I’ve read that pip install foo allows the developers of foo to run arbitrary code on my machine. I don’t mind, as long as I can use Linux user permissions to sandbox it. However, I worry that maybe pip (like apt) could be configured to run… Continue reading Python: Does pip install allow escalation of privileges, e.g. through setuid?
When looking for a way to shrink the attack surface for pypi package-typo-squatting, I came across a package called pip-audit on an article on the RedHat blog.
I attempted to use it, but I’m quite confused about how to use it when in diffe… Continue reading Does pip-audit just search requirements.txt for known CVEs?
I was wondering if there are any open source tools that detect if a host in a network is trying to install a software or pypi package?
Continue reading IDS To Detect software installation in CentOS [migrated]
Before anything, please excuse my clear confusion over what is probably a non-issue. Computer security is definitely not my expertise, so any and all help is appreciated.
I recently installed a Python package through pip that does not have… Continue reading Is this python package safe? I wrongly executed it with admin privileges and would like to know what steps to take to ensure my computer/data is safe
Before anything, please excuse my clear confusion over what is probably a non-issue. Computer security is definitely not my expertise, so any and all help is appreciated.
I recently installed a Python package through pip that does not have… Continue reading Is this python package safe? I wrongly executed it with admin privileges and would like to know what steps to take to ensure my computer/data is safe
Another question (Is it possible to block non-PyPI requests during pip install?) asked about locking down non-PyPI pip installs for security reasons. This doesn’t deal with the problem of malicious packages within PyPI itself. So, I woul… Continue reading How do you lock down PyPI access?
I am trying to install a tool in debian and it won’t run because of that
[-]pip module not found…using ‘ensurepip’ for solve the problem
ensurepip is disabled in Debian/Ubuntu for the system python.
Python modules For the system python … Continue reading Problem with python in debian (Cant guess a better title)
Does python’s pip package manager cryptographically validate its payload’s authentication and integrity for all packages after downloading them and before installing them?
I see a lot of guides providing installation instructions with step… Continue reading Does python’s pip provide cryptographic authentication and integrity validation?
My Fresh kali Linux install doesn’t find pip and so i can’t run my scripts.
So here is what i tried:
kali# pip -V
Command not found
kali# whereis pip
pip:
kali# locate pip | grep /usr/bin
/usr/bin/lesspipe
/usr/bin/pipal
kali# apt-sea… Continue reading pip not found fresh Kali Linux installed [migrated]
So beyond looking at the source code for particular software library, is there a way to vet that it does not contain malicious code? As far as I know from my own research, services like pip, npm, and composer do not provide a… Continue reading How can the validity and safety of a software library be checked?