News for hackers. Stuff that matters.
Re:An analysis of module names inside top PyPI packages by dheera on Thursday July 11, 2024 @01:15AM (#40933869)
Yeah but what is common in real life is writing multiple parallel libraries for {Python, NodeJS, ...} with a nearly identical API. In this case I would think that if the Python command is `pip install foo`, the NodeJS command should be `npm install foo`. It's redundant to do `pip install foo-python` when pip is only for Python, and opens the door for stealthy attacks where someone else creates `pip install foo` on PyPI that is forked from your repo and mirrors your API exactly but steals data and credentials and sends it to malicious servers.
Re:An analysis of module names inside top PyPI packages by kortex on Thursday July 11, 2024 @02:16AM (#40934072)
> when pip is only for Python

That's the neat part, it's not! You can distribute basically any kind of data with pip, within reason. Iirc Cmake can be pip-installed.

Re:An analysis of module names inside top PyPI packages by rented_mule on Thursday July 11, 2024 @03:10AM (#40934335)
`pip install nodejs-bin` gets you node, including npm, in your venv along with bindings for calling it all from Python.