python auth_error ai_generated true

警告：位于 private.example.com 的仓库不是受信任或安全的主机，已被忽略。

WARNING: The repository located at private.example.com is not a trusted or secure host and is being ignored.

ID: python/pip-dependency-confusion-shadowing

其他格式: JSON · Markdown 中文 · English
80%修复率
83%置信度
0证据数
2025-10-20首次发现

版本兼容性

版本状态引入弃用备注
3.x active — — —

根因分析

除非显式信任，pip 拒绝使用纯 HTTP 索引；该警告使 pip 回退到 PyPI，可能安装仿冒包（依赖混淆攻击）。

English

pip refuses to use a plain-HTTP index unless it is explicitly trusted; the warning causes pip to fall back to PyPI, potentially installing a typosquatted package (dependency confusion).

generic

解决方案

  1. 95% 成功率 
    Serve the private index over HTTPS with a valid certificate
  2. 90% 成功率 
    Configure credentials: pip config set global.index-url https://user:[email protected]/simple
  3. 88% 成功率 
    Pin internal packages to the private index only: pip install --index-url https://private.example.com/simple --no-index internal-pkg

无效尝试

常见但无效的做法:

  1. 75% 失败

    Restores HTTP access but does not add authentication, so the private index is still unauthenticated and vulnerable to MITM.

  2. 80% 失败

    Forces all installs through PyPI, reintroducing dependency-confusion risk for internal package names.

  3. 90% 失败

    The fallback to PyPI may silently install a malicious package with the same name.