The Python Package Index (PyPI) is a public repository, and it seems that anyone can upload packages to it using a tool like
twine. The openness of the system raises some questions:
- Say, a person/organization tries to publish a package, but discovers that the name is already taken. How does PyPI resolve these situations? Is there a bidding mechanism? Or is it just first-come-first-serve?
- Let's say someone tries to publish a malicious version of an important package that is in wide use (let's say,
sklearn). How do the developers/maintainers of
sklearnprevent this from happening? Does PyPI provide any mechanisms to ensure that a given package is only published from verified sources?