[gunapologist99]

Even better would be allow their install, but to have them start up with an immediate panic() sort of function (i.e., print("This package has been found to be malicious; please see pypi/evilpackagename for details"); sys.exit(99)) to force aborts of any app using those packages.

[blamestross]

python packages run arbitrary code at install/build time, so this isn't viable.

[qwertox]

It's no longer arbitrary if the PyPI crew is the one who controls the code, or did I understand you wrong?

[blamestross]

Just that it isn't as simple as adding the lines to when the code gets executed. I think I misunderstood you, instead of prepending the code you are suggesting the entire compromised package get replaced with `throw "You got Hacked"` at import time.

[qwertox]

Correct, when the program starts to run and imports the modules, as nothing will make admins more aware that something is really wrong here. Maybe raise an exception which, if not handled, executes sys.exit() with a predefined code.

And some mechanism to detect this at install/build time as well, so that automated built systems can cleanly abort a build and issue a specific message which can then be forwarded via email or SMS through some custom code.

The entire package gets replaced by a standardized, friendly one. No harmful code gets downloaded.

[corty]

Denial of Service by panicing is also harmful for some processes.

[qwertox]

It's not like an already running process will be affected by this.

This would only occur when the package gets updated or reinstalled, which shouldn't happen without supervision if the program is running in a sensitive context.

Else a Denial of Service is a good last resort measure in order to prevent running a malicious service. Ideally this gets detected at install/build time.

[akx]

.whl packages don't run arbitrary code, they're just zips.