🔒 Installed the wrong pypi packages

[swift trout]

I was trying to install pandas, but instead I installed panda as I forgot the s
https://pypi.org/project/panda/#files
do anyone know if this is safe?
I'll acknowledge it's mostly my paranoia, but do anyone know if it is safe?

[wispy aurora]

@swift trout

Python help channel opened

Remember to:

• Ask your Python question, not if you can ask or if there's an expert who can help.
• Show a code sample as text (rather than a screenshot) and the error message, if you've got one.
• Explain what you expect to happen and what actually happens.

:warning: Do not pip install anything that isn't related to your question, especially if asked to over DMs.

Closes after a period of inactivity, or when you send !close.

[swift trout]

Found the github repo, looks innocent? https://github.com/pandastream/panda_client_python/tree/master

[obsidian arrow]

pip uninstall panda

[swift trout]

I ctrl c before it finished installing

• if it's malicious, don't think simply uninstalling it will solve the problem

(as it'll probably move itself to elsewere)

[obsidian arrow]

probably not malicious but there is no reason to have a package u don't know installed

[swift trout]

Oh I stopped installation mid way

Should be fine

Right?

[obsidian arrow]

I don't think there is a reason to worry

[obsidian arrow]

are you saying sarcastically ? it SHOULD be fine.

[swift trout]

I don't know myself

Very paranoid I am

Overthinking stuff

Thanks, anyway

Yeah, I am still very worried despite checking the github repo

[languid bobcat]

Reinstall your OS then on it's dedicated partition

[rapid hill]

well, it will download all its dependency before installing, so ctrl c mid-way probably haven't install it yet

[swift trout]

That's what I did

I also cleared poetry cache and deleted venv

[rapid hill]

it doesn't seem malicious after having a look on browser

https://inspector.pypi.io/project/panda/0.3.1/packages/79/03/74996420528fe488ce17c42b6400531c8067d7eb661c304fa3aa8fdad17c/panda-0.3.1.tar.gz/

[swift trout]

Huh that's a thing?

[rapid hill]

check every file if you are still worry

[rapid hill]

ye

basically a browser of file of each distribution of each version of any package on pypi

[swift trout]

I was checking github, but I was paranoid that the tar file might be different to the github ver

But too afraid to download the tar file

[rapid hill]

they have github? haven't saw it

and also tar file is just a archived(compressed) file and decompress should usually safe

and it should also be safe to open the file in text editor *(unless the text editor have vulunerability which somehow allow code execution, which is rare and extremely limited)

[swift trout]

Yeah looked through the PyPi code

Looks fine

I've never seen real malicious code (nor do I want to)

So I have limited knowledge on these topic

[rapid hill]

well, you wouldn't want to saw it exist on pypi

[radiant rapids]

Can Python even execute any code like that without you running it? I thought it couldn't

[swift trout]

setup.py get ran doesn't it?

[rapid hill]

well, during installing, it run setup.py

[radiant rapids]

Ahh

[swift trout]

I stopped it quite early, not too sure if I am early enough

But then again

The python code looks fine

[radiant rapids]

It seems like it was last updated years ago, I'm assuming even if it was something malicious (which is unlikely in the first place) the security vulnerability it was exploiting got fixed it in that time

[swift trout]

Well, I sure hope so, code from 2015 should be fine

[rapid hill]

-# just know, you do not always need setup.py, installing using .whl doesn't need setup.py

[radiant rapids]

So is that better or worse for security?

[rapid hill]

because .whl basically setup the whole thing so it just copy and paste I assume

[rapid hill]

on one side, it doesn't execute code, which is better

but at the same time, the dev could have put whatever .whl build so it would be diffcult to know whats different in simple way

[swift trout]

It's probably safe, I doubt it even got installed as my venv is empty, it might prioritize stuff already mentioned in lock file, anyway

I just need to convice myself that it's fine

Which is hard, as for some reason, I am afraid of everthing

Sorry for ranting

[rapid hill]

It is probably fine after you look through all the code

[swift trout]

The problem is ... I don't trust myself

[rapid hill]

I look it through and it seems fine

[swift trout]

Thanks

That really helped (not sarcastic)

Installing pandas from now on will give me ptsd

Wait

Poetry install everthing first

Then the package speciflied by add

So it probably never got installed in the first place

(I hope)

[rapid hill]

So what did you do lul

Also if you see Rem online (A person here that is a part of the DevOps team of the server and have a light blue role)

You can ask him to have a look

[swift trout]

Will do

[rapid hill]

(He is a person that contributed to a scanner which attempt to scan all the pypi package for malware)

[swift trout]

Should I ping him

Is it ok to do so?

[rapid hill]

No

By online I mean if he's speaking somewhere in the server

[swift trout]

I will keep in mind, thanks!

[rapid hill]

You could also ask in #cybersecurity if you wanted to

[swift trout]

Yup will do

Didn't know it exsisted

[rapid hill]

Tbf, I just noticed lul

And also the package is most likely nothing wrong(we can never say something is definitely safe)

But I'm just making sure you know it's fine to but give you a life long ptsd

[swift trout]

Well, it seemes to be owned by a company

[swift trout]

Well, I am overly paranoid anyway, I formatted linux partition half a year ago due to similar incident

It was a excuse for me to distrohop

But I was quite worried

[wispy aurora]

Python help channel closed

This help channel has been closed and it's no longer possible to send messages here. If your question wasn't answered, feel free to create a new post in #1035199133436354600. To maximize your chances of getting a response, check out this guide on asking good questions.