Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Have you considered talking to PyPI staff about this?by zahlman
- the packages get flagged or escalated if its at a trust boundary for example if it parses, decodes or authenticates data that an attacker can influence and have either a known CVE or is basically unmaintained. Non trust boundary packages also get reported but not escalated. I welcome contributions to the repo to make it more useful. More info can be found in the readme and docs attached to it.