(3) Why is there not a visible warning when installing one of these packages?
=================
edit:
Reading through the linked blog post [0], it appears these researchers used different code that DID provide visible warning and an cleartext pingback. It also collected command history and hardware information.
Is your project the author of the packages identified by NBU? If so:
(1) Why is the tracking pingback obfuscated?
(2) Why does the code include a cheeky hello instead of a link to https://www.pytosquatting.org/ ?
(3) Why is there not a visible warning when installing one of these packages?
=================
edit:
Reading through the linked blog post [0], it appears these researchers used different code that DID provide visible warning and an cleartext pingback. It also collected command history and hardware information.
[0] http://incolumitas.com/2016/06/08/typosquatting-package-mana...