Request for Comment: Running pre-add and pre-install checks with pip-audit and bandit (and sorts)

[wyleung]

Hi all,

I was wondering whether the poetry team has thoughts about adding a pre-add or pre-install sanitation step where one could run any audit tool for SAST. With typosquatting and account hijacking becoming more tangible and serious nowadays, moving ahead with the current way of installing packages would induce a threat for every user.

Discussions like https://github.com/orgs/python-poetry/discussions/9252 and https://github.com/orgs/python-poetry/discussions/9262 sparked some thoughts and I was really hoping to see effort on the side of PyPi and package installers such as Poetry to secure the ecosystem.

The question would also phrased in the setting: is this something the package/dependency manager should be responsible for and in to which extend?

Open for debate:

• Should Poetry add some mechanism to warn for known threats or black-listed packages (retracted by pypi)
• Should Poetry support mechanism to plug your own prefered package for SAST? (pip-audit, bandit and sorts, just to name a few in this catagory)

Here i'm open for suggestions before moving on to setup a POC and submit a PR for this idea.