Re:An analysis of module names inside top PyPI packages
by dheera on Thursday July 11, 2024 @01:15AM
(#40933869)
Yeah but what is common in real life is writing multiple parallel libraries for {Python, NodeJS, ...} with a nearly identical API. In this case I would think that if the Python command is `pip install foo`, the NodeJS command should be `npm install foo`. It's redundant to do `pip install foo-python` when pip is only for Python, and opens the door for stealthy attacks where someone else creates `pip install foo` on PyPI that is forked from your repo and mirrors your API exactly but steals data and credentials and sends it to malicious servers.
[ Parent
| on HN ]
Re:An analysis of module names inside top PyPI packages
by kortex on Thursday July 11, 2024 @02:16AM
(#40934072)
> when pip is only for Python
That's the neat part, it's not! You can distribute basically any kind of data with pip, within reason. Iirc Cmake can be pip-installed.
Re:An analysis of module names inside top PyPI packages
by rented_mule on Thursday July 11, 2024 @03:10AM
(#40934335)
`pip install nodejs-bin` gets you node, including npm, in your venv along with bindings for calling it all from Python.