Should malware/spam/etc which gets removed from pypi generate advisories here?
Open
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 370
- Forks
- 111
- Avg merge
- 3h 52m
- Merged PRs (30d)
- 4
Description
Following from some discussion in https://github.com/pypa/warehouse/issues/4703, do we think that packages removed from PyPI due to being classified as malware, etc should cause advisories to be generated here?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked discussion in pypa/warehouse#4703, including comment 985270450, and review the 27-comment thread here. The issue names no files, tests, or entry points. Work is not ready until there is a decision and a defined scope for generating advisories from PyPI removals classified as malware or spam.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100