pypi / support

Issue tracker for support requests related to using https://pypi.org
93 stars 48 forks source link

Mass name squat by user: eaybek #3293

Open HCookie opened 10 months ago

HCookie commented 10 months ago

PyPI user performing the mass project name squatting

https://pypi.org/user/eaybek

Additional information

User eaybek holds 52 Projects with only 6 containing code that could be used by another user, with none being updated after March 2020.

A number of these project names are real English words associated with certain actions that may prove useful for other tools to take advantage of. E.g. form, change, nohtml, filestructure, pull ,... . Furthermore, many of these projects can contain the exact same code (shown below) with only the package name changed, a clear indication of name squatting.

class PACKAGENAME(object):
       pass

if __name__ == "__main__":
       print('It works!')

Some of the projects contain invalid GitHub links, so checking the code is not possible.

Additionally, 21 of these projects are marked as "reserved for self usage purpose", which can be considered an invalid package according to the following rule as listed in PEP 541.

- project is abusing the Package Index for purposes it was not intended.

Below is a list of all packages registered by this user sorted into the above categories, (as of 10/23). Hopefully this helps the admins of PyPI in the assessment of this issue.

Package Breakdown

Expand ### Empty Packages - https://pypi.org/project/inbetween/ - https://pypi.org/project/interfare/ - https://pypi.org/project/jx/ ### Copied Packages Contains the same copied code ```python class PACKAGENAME(object): pass if __name__ == "__main__": print('It works!') ``` - https://pypi.org/project/form/ - https://pypi.org/project/change/ - https://pypi.org/project/could/ - https://pypi.org/project/may/ - https://pypi.org/project/nohtml/ - https://pypi.org/project/easl/ - https://pypi.org/project/nojs/ - https://pypi.org/project/nocss/ - https://pypi.org/project/livequery/ - https://pypi.org/project/dataml/ - https://pypi.org/project/split-module/ - https://pypi.org/project/beautyprint/ - https://pypi.org/project/filestructure/ - https://pypi.org/project/mixpack/ - https://pypi.org/project/brainduck/ - https://pypi.org/project/utilio/ - https://pypi.org/project/skive/ ### Self Usage Documentation indicates that the namespace is reserved for "self usage purpose" - https://pypi.org/project/passgenerate/ - https://pypi.org/project/pull/ - https://pypi.org/project/content/ - https://pypi.org/project/content-manager/ - https://pypi.org/project/contentmanager/ - https://pypi.org/project/mvrt/ - https://pypi.org/project/cmdroute/ - https://pypi.org/project/cmdrouter/ - https://pypi.org/project/nameit/ - https://pypi.org/project/uiplug/ - https://pypi.org/project/unified/ - https://pypi.org/project/dotpool/ - https://pypi.org/project/mngr/ - https://pypi.org/project/kwset/ - https://pypi.org/project/catirt/ - https://pypi.org/project/fastpress/ - https://pypi.org/project/cmp/ - https://pypi.org/project/eventpub/ - https://pypi.org/project/getir/ - https://pypi.org/project/bouquet/ - https://pypi.org/project/doob/ ### Questionable Packages These packages contain real code, but contain no documentation, and some reference local paths. Should these be published as PyPI packages or just as git repositories? - https://github.com/eaybek/edit/ Contains no documentation and single use code, references local paths - https://pypi.org/project/exposer/ No docs - https://pypi.org/project/hard/ No docs - https://pypi.org/project/sna/ No docs - https://pypi.org/project/specialless/ No docs ### Potentially Real Packages These packages are potentially useful, but contain limited documentation. - https://pypi.org/project/getthat/ - https://pypi.org/project/seperator/ - https://github.com/eaybek/unstdio/ - https://pypi.org/project/ipynote/ - https://pypi.org/project/apiguard/ - https://pypi.org/project/alyssum/

Personal Note

This user was found as they hold a package name I am interested in acquiring for the release of a package currently in active development. If the PyPI admins deem this user in violation of the terms, I would like to request a transfer of the edit namespace to myself Hcookie. This namespace would then be used to publish a new package.

Code of Conduct

HCookie commented 7 months ago

Hoping to bump this issue, and have it resolved. @di