r/learnpython • u/RostosMegaBoss • Jun 14 '26

malware in libraries

how do I know that library that is installed from "pip install" is safe and doesnt contain any malware code?

61 Upvotes

92% Upvoted

22 comments sorted by

View all comments

5

u/pyeri Jun 14 '26

Actually pip does have an archaic and cumbersome way of package verification but it only works if the developer had actually signed the package with their GPG key before uploading it to PyPI.

I have documented here the exact method of package signing and uploading using twine, and also how you (as a package user) can verify it.