3 ms·

I think the issue isn't so much malicious authors, it's compromised repositories and compromised repositories as dependencies. Blue check would gatekeep a lot

• zzzeek 4y ago
  these aren't compromised repositories on pypi, these are fully legitimate repos started by bad actors that intentionally use similar sounding names and readmes. a system by which all of the major packages and dependencies are coming in, which to be clear is the whole pile of stuff that people aren't usually looking at, on a set of trusted authors and where someone who is being careful can whitelist specific repos for newer projects they want to use would reduce the problem to almost nothing.