PyPI mirror proxy that injects code and bypasses pip hash verification

1. badpie

   1 1 18 3.3 Python

   

2. InfluxDB

   www.influxdata.com featured

   InfluxDB – Built for High-Performance Time Series Workloads. InfluxDB 3 OSS is now GA. Transform, enrich, and act on time series data directly in the database. Automate critical tasks and eliminate the need to move data externally. Download now.

   

3. pip

   2 127 10,040 9.8 Python

   The Python package installer

   

   Yes, if you control the index, you can lie to pip about what the package's hash should be. This is why you have to opt in to using a different index, and why the connection to PyPI has been properly secured since forever (https://github.com/pypa/pip/issues/425 ; note the date).

   The clearly AI-generated README is also confused about how this works. It claims:

   > Intercepts package index requests and rewrites URLs to point to the malicious mirror

   but it's actually implementing a malicious mirror by forwarding requests to PyPI and then serving a modified version of the PyPI result. "Preserves and updates SHA256 hashes for modified packages" is also an incoherent description; preserving something and modifying it are mutually incompatible.

Suggest a related project