Where can I find DoD approved Python library repo?

To Whom It may concern,

I work in the Dept of Navy. I have been tasked by my leadership to get information and guidance on DoD policy and resources for using open source software libraries. Especially Python libraries. Most developers go to PyPI.org (Python package index) to download, install and run Python libraries. It is the reality that PyPI.org contributors have found malware in approved python open source libraries.

Here is PyPI.org’s policy and stance:
“PyPI has a procedure for reporting security concerns. If someone reports a malicious package or a problem within PyPI it is addressed, but packages added to PyPI do not undergo review—this would be an unrealistic expectation of the volunteers who maintain PyPI. Therefore it is wise to assume that there are malicious packages within PyPI and behave accordingly. Reasonable steps include doing a bit of research on the package you want to install and ensuring that you carefully spell out the package name (a package named for a common misspelling of a popular package could execute malicious code).”

My main question(s).
1. Does the DoD maintain a repository of approved Python libraries?
2. If not, what is the DoD’s policy for developers to download and install open source packages on the internet on to their Govt machines?
3. Does the DoD recommend any software vulnerability scanners that can be installed on Govt machines for developers to scan for vulnerabilities of the open source libraries they are using?
Any help, guidance and resources would be greatly appreciated?

这是一个政策和资源请求，而不是一项已定义的代码变更。首先审查有关已批准 Python 仓库、包安装政策和漏洞扫描器的问题；要视为完成，需要有针对每个问题的权威答案和链接。

由索引模型根据 Issue 内容生成。