Malicious software libraries found in PyPI posing as well known libraries
The regex they have for identifying fake/harmful packages is wrong.<p>`pip list –format=legacy | egrep '^(acqusition|apidev-coop|bzip|crypt|django-server|pwd|setup-tools|telnet|urlib3|urllib) '`<p>This incorrectly lists `urllib3` or the `cryptography` package for example, which are perfectly valid packages.<p>[UPDATE]<p>Read "tobltobs" comment below. I incorrectly removed a trailing space from the regex.