# WARNING: The repository located at private.example.com is not a trusted or secure host and is being ignored.

- **ID:** `python/pip-dependency-confusion-shadowing`
- **Domain:** python
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

pip refuses to use a plain-HTTP index unless it is explicitly trusted; the warning causes pip to fall back to PyPI, potentially installing a typosquatted package (dependency confusion).

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.x | active | — | — |

## Workarounds

1. **** (95% success)
   ```
   Serve the private index over HTTPS with a valid certificate
   ```
2. **** (90% success)
   ```
   Configure credentials: pip config set global.index-url https://user:token@private.example.com/simple
   ```
3. **** (88% success)
   ```
   Pin internal packages to the private index only: pip install --index-url https://private.example.com/simple --no-index internal-pkg
   ```

## Dead Ends

- **** — Restores HTTP access but does not add authentication, so the private index is still unauthenticated and vulnerable to MITM. (75% fail)
- **** — Forces all installs through PyPI, reintroducing dependency-confusion risk for internal package names. (80% fail)
- **** — The fallback to PyPI may silently install a malicious package with the same name. (90% fail)