5 ms·

Show HN: Pipask – safer pip without compromising convenience

52 points by Feynmanix 1y ago

Pipask is a drop-in replacement for pip that addresses a serious security flaw: standard pip executes arbitrary code from source distributions during dependency resolution, without warning or consent. Pipask retrieves metadata through PyPI's JSON API first, then checks repository popularity, download counts, package age, and known vulnerabilities before allowing installation. It presents you with a pretty report and asks for you consent with installation, giving you control over what code runs on your system. More details in the intro blog post: https://medium.com/data-science-collective/pipask-know-what-youre-installing-before-it-s-too-late-2a6afce80987 https://medium.com/data-science-collective/pipask-know-what-...

omneity 1y ago
This looks great, congrats on the release! So what are the potential risks/downsides? As in what’s the tradeoff that is being made when relying on pipask?
- Feynmanix 1y ago
  Thanks! Good question. I think the main downsides are: - installation takes a few more seconds to do the checks - you need to trust me, a random person from the internet - if there are any subtle differences between pip versions, the checks may be done for different versions than will be actually installed (I've done my best to prevent this for pip versions 22.2 to current latest), or if I missed any bugs, you may get an error you wouldn't get with pip The current version is also interactive only - requires user confirmation, though I'm open to adding a non-interactive mode in the future.
  - omneity 1y ago
    Thank you for the answers. Sounds reasonable in my book (what's one more internet stranger to trust, hah). I'll give it a try!
roywiggins 1y ago
Seems like a natural fit for plugging into vibe coding tools that would otherwise cheerfully pip install whatever. https://www.techradar.com/pro/security/ai-hallucinated-names-resembling-popular-libraries-created-for-slopsquatting-attacks https://www.techradar.com/pro/security/ai-hallucinated-names...
- Feynmanix 1y ago
  Great point! If you alias pip to pipask in your .*rc file, than this should already work out of the box for some tools, but there may be problems such as the need for non-interactive flows and configuring failure thresholds. I'll think about this use case more!
  - omneity 1y ago
    Seconding this use case! I see pipask helping greatly as another safety net when using coding agents.
  - roywiggins 1y ago
    It occurs to me that if people are executing pip over requirements.txt outputs it would work and be very helpful, but if they're giving LLM agents shell access directly probably the main problem is going to be finding a way for pipask to try to confirm that it's talking to a human and not just the LLM again (impossible in general but still)... probably out of scope though!
the__alchemist 1y ago
I speculate that the group of users that are both A: Willing to install something beyond Pip for package management, and B: aren't willing to install a proper dependency resolver (uv, etc) is small. If you are willing to use a third-party package tool (big leap), I think it's a small step to use one that fixes all of pip's limitations, vice a single one.
- happytoexplain 1y ago
  Isn't pip third party? Which makes your point stronger.
  - zahlman 1y ago
    Yes and no. Pip is nominally developed by separate people and isn't part of the standard library. However, it does ship with Python by default (Debian-based Linux distributions go out of their way to remove it), in the form of a wheel vendored within the standard library folders. The standard library module `ensurepip` is used to install that wheel - it bootstraps Pip's own code from within that wheel. This is also used indirectly by default when you create a new venv with the standard library `venv`. (The reason uv can create environments quickly is that it skips that part, while otherwise following nominally the same logic. You can get the same effect by passing `--without-pip` to the `python -m venv` invocation, and it's actually faster (on my machine at least) than using uv. However, you then need to understand how to use pip cross-environment (it wasn't designed for that from the start, but modern pip offers support that's only a little bit buggy). I discuss this on my blog in https://zahlman.github.io/posts/2025/01/07/python-packaging-2/ https://zahlman.github.io/posts/2025/01/07/python-packaging-... .)
- Feynmanix 1y ago
  Perhaps it's not clear from my description above, but I'm afraid the flaw is in the Python package ecosystem itself rather than pip. I'm not very familiar with uv, but from what I can tell from the documentation, it needs to execute the same steps as pip to resolve metadata, as this is required by various PEPs. (You can have a look at the diagram in the linked blog post https://medium.com/data-science-collective/pipask-know-what-youre-installing-before-it-s-too-late-2a6afce80987#7ae4 https://medium.com/data-science-collective/pipask-know-what-...). But I also get your point - advanced users who care about security may not be using pip. Implementing the functionality as a plugin for uv or poetry is actually the next step I'm considering, if people find the concept of pipask useful. What do you think?
ATechGuy 1y ago
Looks like a useful tool. Congrats on shipping! Many packages are installed automatically in environments like CI/CD pipelines or Dockerfiles, where interactive review and consent aren't possible. How do you plan to handle such scenarios?
- Feynmanix 1y ago
  Ideally, you should use lockfiles for your CI/CD or docker. To create or update the lockfile, a developer needs to install dependencies manually first (as in `pip install X` -> `pip freeze`), at which point the checks would be executed and the user would consent. That said, it's pretty uncommon to use lockfiles with pip, so I'm considering creating something like a plugin for poetry or uv, if there is demand?
  - zahlman 1y ago
    Quite a few people use requirements.txt files with pip actually. I've seen many projects that even expect end users to do so. You might not notice - exactly because they aren't packaging for PyPI.
    - Feynmanix 1y ago
      But before committing requirements.txt to git, they still run install locally, right?
      - zahlman 1y ago
        Sure, they presumably have a local dev environment where they install dependencies to test their own code. But there are a lot of possible workflows around that. Some people might separately install things one at a time according to what they appear to need as they're developing, and then use `pip freeze` to create the `requirements.txt` file. Others might edit `requirements.txt` directly, and repeatedly re-create their environment based off that. Still others might involve any number of tools here, such as pip-tools (https://pypi.org/project/pip-tools/ https://pypi.org/project/pip-tools/), pipenv (https://pypi.org/project/pipenv/ https://pypi.org/project/pipenv/), etc.
zahlman 1y ago
So, this is a fork of pip that adds the described checks to the UI? Looks like it also doesn't vendor dependencies like pip does, which is probably fine - you'll have to use something like (like pip) to bootstrap it, but this doesn't have the special-case requirements that motivate that design choice for pip (like being bootstrapped via standard library `ensurepip`).
- Feynmanix 1y ago
  Yes, the reason I had to fork pip was that the dependency resolution logic is too complex and I couldn't recreate it from scratch with fidelity. You're right I don't vendor dependencies, and I hope to get away with it exactly because I don't have the bootstrapping problem. In practice, you want to install pipask with pipx so that the dependencies don't mess with your local environment.
scsh 1y ago
I like the idea of having vuln reporting in the installation step. Looking at the examples provided though, I think the vulnerability reporting could use a bit more information. Using the fastapi example, it points to CVE-2024-24762 which, if you're looking at the NIST or CVE pages for it, doesn't give the clearest info for how to resolve. Maybe consider linking to advisories in the Python Packaging Advisory Database when possible, like pip-audit does. https://osv.dev/vulnerability/PYSEC-2024-38 https://osv.dev/vulnerability/PYSEC-2024-38 is a lot clearer that fastapi is affected and which version fixed the vulnerability.
- Feynmanix 1y ago
  It's not visible on the screenshot for some reason, but if you run the latest version, you'll notice a little underline under the CVE mention. It's actually a hyperlink (Cmd+click in iTerm2) that leads to https://osv.dev/vulnerability/CVE-2024-24762 https://osv.dev/vulnerability/CVE-2024-24762 where you can find out more. Or are you saying you'd rather it leads to https://osv.dev/vulnerability/PYSEC-2024-38 https://osv.dev/vulnerability/PYSEC-2024-38 rather than https://osv.dev/vulnerability/CVE-2024-24762 https://osv.dev/vulnerability/CVE-2024-24762 ?
  - simonw 1y ago
    Can it spit out a visible URL for those of us who use the default macOS terminal app?
    - Feynmanix 1y ago
      Yes, I can! Will be in the next release
  - scsh 1y ago
    Yes in this particular case, where I'm trying to install fastapi, I'd rather it direct me to https://osv.dev/vulnerability/PYSEC-2024-38 https://osv.dev/vulnerability/PYSEC-2024-38 which is more fastapi specific and mentions that the fixed version of fast api is 0.109.1. Or even better, give the link and print the fixed version from the advisory yaml https://github.com/pypa/advisory-database/blob/main/vulns/fastapi/PYSEC-2024-38.yaml https://github.com/pypa/advisory-database/blob/main/vulns/fa...
ashishbijlani 1y ago
Plug: I've been building a similar tool: https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect impersonating packages (typo squatting).
- Feynmanix 1y ago
  Thanks, I'll have a look, possibly add a link to it

52 points by Feynmanix 1y ago

omneity 1y ago

This looks great, congrats on the release! So what are the potential risks/downsides? As in what’s the tradeoff that is being made when relying on pipask?

Feynmanix 1y ago
Thanks! Good question. I think the main downsides are: - installation takes a few more seconds to do the checks - you need to trust me, a random person from the internet - if there are any subtle differences between pip versions, the checks may be done for different versions than will be actually installed (I've done my best to prevent this for pip versions 22.2 to current latest), or if I missed any bugs, you may get an error you wouldn't get with pip The current version is also interactive only - requires user confirmation, though I'm open to adding a non-interactive mode in the future.
- omneity 1y ago
  Thank you for the answers. Sounds reasonable in my book (what's one more internet stranger to trust, hah). I'll give it a try!

roywiggins 1y ago

Seems like a natural fit for plugging into vibe coding tools that would otherwise cheerfully pip install whatever. https://www.techradar.com/pro/security/ai-hallucinated-names-resembling-popular-libraries-created-for-slopsquatting-attacks https://www.techradar.com/pro/security/ai-hallucinated-names...

Feynmanix 1y ago
Great point! If you alias pip to pipask in your .*rc file, than this should already work out of the box for some tools, but there may be problems such as the need for non-interactive flows and configuring failure thresholds. I'll think about this use case more!
- omneity 1y ago
  Seconding this use case! I see pipask helping greatly as another safety net when using coding agents.
- roywiggins 1y ago
  It occurs to me that if people are executing pip over requirements.txt outputs it would work and be very helpful, but if they're giving LLM agents shell access directly probably the main problem is going to be finding a way for pipask to try to confirm that it's talking to a human and not just the LLM again (impossible in general but still)... probably out of scope though!

the__alchemist 1y ago

I speculate that the group of users that are both A: Willing to install something beyond Pip for package management, and B: aren't willing to install a proper dependency resolver (uv, etc) is small. If you are willing to use a third-party package tool (big leap), I think it's a small step to use one that fixes all of pip's limitations, vice a single one.

happytoexplain 1y ago
Isn't pip third party? Which makes your point stronger.
- zahlman 1y ago
  Yes and no. Pip is nominally developed by separate people and isn't part of the standard library. However, it does ship with Python by default (Debian-based Linux distributions go out of their way to remove it), in the form of a wheel vendored within the standard library folders. The standard library module `ensurepip` is used to install that wheel - it bootstraps Pip's own code from within that wheel. This is also used indirectly by default when you create a new venv with the standard library `venv`. (The reason uv can create environments quickly is that it skips that part, while otherwise following nominally the same logic. You can get the same effect by passing `--without-pip` to the `python -m venv` invocation, and it's actually faster (on my machine at least) than using uv. However, you then need to understand how to use pip cross-environment (it wasn't designed for that from the start, but modern pip offers support that's only a little bit buggy). I discuss this on my blog in https://zahlman.github.io/posts/2025/01/07/python-packaging-2/ https://zahlman.github.io/posts/2025/01/07/python-packaging-... .)
Feynmanix 1y ago
Perhaps it's not clear from my description above, but I'm afraid the flaw is in the Python package ecosystem itself rather than pip. I'm not very familiar with uv, but from what I can tell from the documentation, it needs to execute the same steps as pip to resolve metadata, as this is required by various PEPs. (You can have a look at the diagram in the linked blog post https://medium.com/data-science-collective/pipask-know-what-youre-installing-before-it-s-too-late-2a6afce80987#7ae4 https://medium.com/data-science-collective/pipask-know-what-...). But I also get your point - advanced users who care about security may not be using pip. Implementing the functionality as a plugin for uv or poetry is actually the next step I'm considering, if people find the concept of pipask useful. What do you think?

ATechGuy 1y ago

Looks like a useful tool. Congrats on shipping! Many packages are installed automatically in environments like CI/CD pipelines or Dockerfiles, where interactive review and consent aren't possible. How do you plan to handle such scenarios?

Feynmanix 1y ago
Ideally, you should use lockfiles for your CI/CD or docker. To create or update the lockfile, a developer needs to install dependencies manually first (as in `pip install X` -> `pip freeze`), at which point the checks would be executed and the user would consent. That said, it's pretty uncommon to use lockfiles with pip, so I'm considering creating something like a plugin for poetry or uv, if there is demand?
- zahlman 1y ago
  Quite a few people use requirements.txt files with pip actually. I've seen many projects that even expect end users to do so. You might not notice - exactly because they aren't packaging for PyPI.
  - Feynmanix 1y ago
    But before committing requirements.txt to git, they still run install locally, right?
    - zahlman 1y ago
      Sure, they presumably have a local dev environment where they install dependencies to test their own code. But there are a lot of possible workflows around that. Some people might separately install things one at a time according to what they appear to need as they're developing, and then use `pip freeze` to create the `requirements.txt` file. Others might edit `requirements.txt` directly, and repeatedly re-create their environment based off that. Still others might involve any number of tools here, such as pip-tools (https://pypi.org/project/pip-tools/ https://pypi.org/project/pip-tools/), pipenv (https://pypi.org/project/pipenv/ https://pypi.org/project/pipenv/), etc.

zahlman 1y ago

So, this is a fork of pip that adds the described checks to the UI? Looks like it also doesn't vendor dependencies like pip does, which is probably fine - you'll have to use something like (like pip) to bootstrap it, but this doesn't have the special-case requirements that motivate that design choice for pip (like being bootstrapped via standard library `ensurepip`).

Feynmanix 1y ago
Yes, the reason I had to fork pip was that the dependency resolution logic is too complex and I couldn't recreate it from scratch with fidelity. You're right I don't vendor dependencies, and I hope to get away with it exactly because I don't have the bootstrapping problem. In practice, you want to install pipask with pipx so that the dependencies don't mess with your local environment.

scsh 1y ago

I like the idea of having vuln reporting in the installation step. Looking at the examples provided though, I think the vulnerability reporting could use a bit more information. Using the fastapi example, it points to CVE-2024-24762 which, if you're looking at the NIST or CVE pages for it, doesn't give the clearest info for how to resolve. Maybe consider linking to advisories in the Python Packaging Advisory Database when possible, like pip-audit does. https://osv.dev/vulnerability/PYSEC-2024-38 https://osv.dev/vulnerability/PYSEC-2024-38 is a lot clearer that fastapi is affected and which version fixed the vulnerability.

Feynmanix 1y ago
It's not visible on the screenshot for some reason, but if you run the latest version, you'll notice a little underline under the CVE mention. It's actually a hyperlink (Cmd+click in iTerm2) that leads to https://osv.dev/vulnerability/CVE-2024-24762 https://osv.dev/vulnerability/CVE-2024-24762 where you can find out more. Or are you saying you'd rather it leads to https://osv.dev/vulnerability/PYSEC-2024-38 https://osv.dev/vulnerability/PYSEC-2024-38 rather than https://osv.dev/vulnerability/CVE-2024-24762 https://osv.dev/vulnerability/CVE-2024-24762 ?
- simonw 1y ago
  Can it spit out a visible URL for those of us who use the default macOS terminal app?
  - Feynmanix 1y ago
    Yes, I can! Will be in the next release
- scsh 1y ago
  Yes in this particular case, where I'm trying to install fastapi, I'd rather it direct me to https://osv.dev/vulnerability/PYSEC-2024-38 https://osv.dev/vulnerability/PYSEC-2024-38 which is more fastapi specific and mentions that the fixed version of fast api is 0.109.1. Or even better, give the link and print the fixed version from the advisory yaml https://github.com/pypa/advisory-database/blob/main/vulns/fastapi/PYSEC-2024-38.yaml https://github.com/pypa/advisory-database/blob/main/vulns/fa...

ashishbijlani 1y ago

Plug: I've been building a similar tool: https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj Packj uses static+dynamic code/behavioral analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect impersonating packages (typo squatting).

Feynmanix 1y ago
Thanks, I'll have a look, possibly add a link to it