Search code examples
pythonpipprivacymalware-detection

Can python modules downloaded through pip(3) “phone home”, with logs of your activity?

Do I understand correctly that the best way to make sure is to go through module’s code and see for myself?

Solution

  • Yes.

    When you install Python modules through PIP, you are installing any code contained within those modules. And note that Python modules allow code execution not only at run time, but also at install time. To prevent this, only install binary distribution Python wheels using the --only-binary :all: flag. This avoids arbitrary code execution on installation (by avoiding setup.py).

    In addition to this, you can also help mitigate against malicious packages by:

    • Installing packages with the local user using the --user flag.
    • And installing packages in hash-checking mode using the --require-hashes flag.