python auth_error ai_generated true

WARNING: The repository located at private.example.com is not a trusted or secure host and is being ignored.

ID: python/pip-dependency-confusion-shadowing

Also available as: JSON · Markdown · 中文
80%Fix Rate
83%Confidence
0Evidence
2025-10-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
3.x active — — —

Root Cause

pip refuses to use a plain-HTTP index unless it is explicitly trusted; the warning causes pip to fall back to PyPI, potentially installing a typosquatted package (dependency confusion).

generic

中文

除非显式信任，pip 拒绝使用纯 HTTP 索引；该警告使 pip 回退到 PyPI，可能安装仿冒包（依赖混淆攻击）。

Workarounds

  1. 95% success 
    Serve the private index over HTTPS with a valid certificate
  2. 90% success 
    Configure credentials: pip config set global.index-url https://user:[email protected]/simple
  3. 88% success 
    Pin internal packages to the private index only: pip install --index-url https://private.example.com/simple --no-index internal-pkg

Dead Ends

Common approaches that don't work:

  1. 75% fail

    Restores HTTP access but does not add authentication, so the private index is still unauthenticated and vulnerable to MITM.

  2. 80% fail

    Forces all installs through PyPI, reintroducing dependency-confusion risk for internal package names.

  3. 90% fail

    The fallback to PyPI may silently install a malicious package with the same name.