PyPI name "visqol" is squatted by a malicious package
- Dominant language
- C++
- Stars
- 928
- Forks
- 144
- PR merge metrics
- No merged PRs in 30d
Description
The package name `visqol` on PyPI has been claimed by a malicious squatting package:
https://pypi.org/project/visqol/
The package (`visqol` 0.1.0) has no relation to this project. It was published by an author using the alias `sectest` (`sectest@example.com`) and contains no legitimate functionality. Key concerns:
- **Name squatting:** Blocks any future official PyPI release of ViSQOL under its canonical name.
- **Namespace poisoning:** Despite being named `visqol`, the package installs a `pyav` module that shadows the legitimate [PyAV](https://pypi.org/project/PyAV/) library.
- **Payload staging:** The sole code file contains an unused `import os` and a debug print statement, consistent with a placeholder for future malicious updates.
- **All metadata is boilerplate:** Description is `"Your package description"`, homepage points to `https://github.com/yourusername/ipablepytorch3`, and the README contains only `sec-test`.
A PyPI abuse report should be filed (or may already be in progress) to have the package removed. If your team intends to publish ViSQOL to PyPI in the future, it would be worth coordinating with PyPI to reclaim the name.
Contributor guide
Assessment
This issue has not been assessed yet.