3 ms·
My team is using Poetry. Did you know pip can execute arbitrary code when installing packages?
by dharmab 4y ago
My team is using Poetry.
Did you know pip can execute arbitrary code when installing packages?
- teruakohatu 4y agoI use poetry but regardless as soon as you import a library arbitrary code is executed.
- matusf 4y ago[dead]
- uranusjr 4y agoJust fyi Poetry is still using pip under the hood. Also (unrelated to Poetry’s pip usage) if you ever build a dependency from source (the situation where pip executes arbitrary code), Poetry also executes arbitrary code.