the packages get flagged or escalated if its at a trust boundary for example if it parses, decodes or authenticates data that an attacker can influence and have either a known CVE or is basically unmaintained. Non trust boundary packages also get reported but not escalated. I welcome contributions to the repo to make it more useful. More info can be found in the readme and docs attached to it.
the packages get flagged or escalated if its at a trust boundary for example if it parses, decodes or authenticates data that an attacker can influence and have either a known CVE or is basically unmaintained. Non trust boundary packages also get reported but not escalated. I welcome contributions to the repo to make it more useful. More info can be found in the readme and docs attached to it.
Have you considered talking to PyPI staff about this?
I dont know how I can reach them, I would love to get their feedback on this
There's a public Python packaging Discord https://discord.gg/pypa , or you can try emailing the Packaging Work Group (see info at https://wiki.python.org/psf/PackagingWG ), although the latter is probably deprecated. You can also try the Packaging section of the official Python forums: https://discuss.python.org/c/packaging/14
joined the discord chat, thank you for suggesting this to me
[flagged]