Skip to content

fix: remove unregistered pebble-loghash dependency (dependency confusion)#20

Open
x4v13r64 wants to merge 1 commit intogoogle:mainfrom
x4v13r64:fix/remove-nonexistent-pypi-packages
Open

fix: remove unregistered pebble-loghash dependency (dependency confusion)#20
x4v13r64 wants to merge 1 commit intogoogle:mainfrom
x4v13r64:fix/remove-nonexistent-pypi-packages

Conversation

@x4v13r64
Copy link
Copy Markdown

@x4v13r64 x4v13r64 commented Mar 21, 2026

pebble.loghash in python_libs/pebble-commander/setup.py extras_require is not a registered PyPI package. pip normalises the name to pebble-loghash for index lookups, and neither form is registered.

An attacker who registers pebble-loghash>=2.6 on PyPI would have their package installed whenever anyone runs pip install pebble.commander[Interactive], gaining arbitrary code execution during hardware debugging sessions.

This PR removes pebble.loghash from the Interactive extras group.

@google-cla
Copy link
Copy Markdown

google-cla bot commented Mar 21, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@x4v13r64
Copy link
Copy Markdown
Author

@Hexxeh can you review this please?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant