PyPI

• Assume that there are malicious packages within PyPI. Do a bit of research on the package you want to install and carefully spell out the package name when installing it (a package named for a common misspelling of a popular package could execute malicious code).

• Make yourself familiar with the licenses necessary for the projects you use, so you are sure that you are not compromising yourself legally.

• Scan for security vulnerabilities with Bandit, available through the Python Packaging Index (PyPI)

• Use Pipenv, a tool for managing the competing interests of having a predictable development environment and having an up-to-date development and production environment. It uses a two-file system that separates abstract dependency declarations from the last tested combination.

• Even when using Python 3, it is still important to keep in mind that import statements execute the code within the target module.

• The requests library handles SSL certificate verification. This library uses a package called certifi to validate the trustworthiness of certificate authorities. Maintaining the most updated version of certifi and never ever pin this dependency. Oh, and do not bypass a certificate verification request.

• Do not deserialise data from an untrusted source, and for PyYAML always use yaml.safe_load.

• Look into dependency analysis tools. There are some free tools available such as ochrona.