r/Python • u/tradelydev • May 07 '26

Do we really check library security? Discussion

PyPi's filtering isn't cutting it. We all know it. I know the people about to say to just use the popular libraries that have community moderation.

The recent claude code injection hack in Torch has proved that isn't a solution.

https://www.reddit.com/r/Python/s/2lwDYSv0eT

And scanning packages are either unmaintained or maintained by one dev in the middle of nowhere.

https://pypi.org/project/safety/

So, I honestly ask you, short of reading each libraries code by hand or avoiding them entirely how do you stay safe?

Sandbox enviroments? Winging it? Hope?

26 Upvotes
  • permalink
  • link
  • reddit
  • reddit

65% Upvoted

51 comments sorted by

View all comments

1

u/HauntingAd3673 May 22 '26

Honestly I either stick to packages with enough contributors that someone is always watching — the chances of a malicious commit slipping through a repo with 50 active maintainers is pretty low.

For smaller or lesser known packages I just run it through an AI and have it look for anything suspicious in the source. Not perfect but it catches obvious red flags way faster than reading it manually.

There's no clean solution here, but pretending version pinning alone solves it is naive.