python auth_error ai_generated true

警告：在 PyPI 上找到了包 'internal-utils'，但您组织的私有索引也托管了同名包。由于 PyPI 上的版本更高，pip 选择了 PyPI。

WARNING: The package 'internal-utils' was found on PyPI, but your organization's private index also hosts a package with the same name. pip selected PyPI because it has a higher version.

ID: python/pip-dependency-confusion-internal-package

其他格式: JSON · Markdown 中文 · English
80%修复率
86%置信度
0证据数
2025-08-25首次发现

版本兼容性

版本状态引入弃用备注
3.8 active — — —
3.9 active — — —
3.10 active — — —
3.11 active — — —
3.12 active — — —

根因分析

pip 的默认索引优先级允许公共包遮蔽同名的内部包，这是依赖混淆攻击的途径。

English

pip's default index priority allows a public package to shadow an internal package with the same name, a dependency-confusion attack vector.

generic

解决方案

  1. 90% 成功率 
    pip install --index-url https://internal.example.com/simple internal-utils
  2. 80% 成功率 
    In pip.conf: `[global]\nindex-url = https://internal.example.com/simple\nextra-index-url = https://pypi.org/simple` and use a resolver that respects priority (e.g., uv with `--index-strategy unsafe-best-match` disabled).
  3. 95% 成功率 
    Register placeholder packages on PyPI for all internal names to prevent squatting.

无效尝试

常见但无效的做法:

  1. 90% 失败

    Trusted-host only affects TLS verification, not index priority.

  2. 70% 失败

    Pinning the version does not prevent pip from fetching that version from PyPI if it exists there.

  3. 85% 失败

    Extra indexes are merged with PyPI, so the confusion risk remains.