Dozens of malicious PyPI packages discovered targeting developers

Re:Dozens of malicious PyPI packages discovered targeting de... by dheera on Wednesday November 02, 2022 @06:21PM (#33443720)

pip throws your dependencies in some lib directory either on your system (default if you use sudo), in your home directory (default if you don't use sudo), or inside your virtualenv's lib directory.

npm pulls dependencies into node_modules as a subdirectory of your own project as default.

Python really should consider doing something similar. Dependencies shouldn't live outside your project folder. We are no longer in an era of hard drive space scarcity.

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by coredog64 on Wednesday November 02, 2022 @06:40PM (#33443868)

As of Python 3, pip install into the system Python lib directory is strongly discouraged. ISTR that even using pip to update pip results in a warning.

That’s not to say that there’s not still some libs out there that haven’t updated docs to get with the times.

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by kevin_thibedeau on Thursday November 03, 2022 @04:30AM (#33448403)

More distros should adopt the Debian practice of installing into dist-packages and leaving site-packages as a /usr/local equivalent for pip to use on it's own.

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by cozzyd on Wednesday November 02, 2022 @06:58PM (#33444034)

Have you seen how much space a virtualenv uses? It can easily be >1 GB. For every project, this adds up. (Not to mention the bandwidth, which is not always plentiful).

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by dheera on Wednesday November 02, 2022 @07:20PM (#33444226)

4TB hard drives are $300 these days.

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by mardifoufs on Wednesday November 02, 2022 @11:24PM (#33446605)

4tb HDDs are closer to 80$ now, but that reinforces your point :). Even SSDs are now close to 300$ for 4tb!

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by dheera on Thursday November 03, 2022 @12:52PM (#33453851)

Yeah i meant 4TB SSDs, who uses magnetic HDDs anymore lol

[ Parent | on HN ]

Re:Dozens of malicious PyPI packages discovered targeting de... by hnbad on Thursday November 03, 2022 @09:26AM (#33450597)

Well, npm uses a cache so it won't re-download every package every time you install it.

[ Parent | on HN ]