Malicious software libraries found in PyPI posing as well known libraries
Ok, here&#x27;s some ugly backstory on this:
This problem has been known for a while, yet both the pypi devs and the python security team decided to ignore it.<p>Last year someone wrote his thesis describing python typosquatting and standard library name squatting:
<a href="http:&#x2F;&#x2F;incolumitas.com&#x2F;2016&#x2F;06&#x2F;08&#x2F;typosquatting-package-managers&#x2F;" rel="nofollow">http:&#x2F;&#x2F;incolumitas.com&#x2F;2016&#x2F;06&#x2F;08&#x2F;typosquatting-package-mana...</a><p>However after that the packages used in this thesis - the most successful one being urllib2 - weren&#x27;t blocked, they were deleted. Benjamin Bach was able to register urllib2 afterwards. Benjamin and I decided that we&#x27;d now try to register as many stdlib names as possible.<p>See also:
<a href="https:&#x2F;&#x2F;www.pytosquatting.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.pytosquatting.org&#x2F;</a>