Skip to content

fix: remove nonexistent sys-stdout dependency (dependency confusion)#10

Open
x4v13r64 wants to merge 1 commit intogoogle:masterfrom
x4v13r64:fix/remove-nonexistent-pypi-packages
Open

fix: remove nonexistent sys-stdout dependency (dependency confusion)#10
x4v13r64 wants to merge 1 commit intogoogle:masterfrom
x4v13r64:fix/remove-nonexistent-pypi-packages

Conversation

@x4v13r64
Copy link

@x4v13r64 x4v13r64 commented Mar 21, 2026

sys-stdout in Pipfile is not a registered PyPI package — it conflates sys.stdout (Python's standard output stream object) with an installable package name. It is not needed for the bootstrapper's functionality.

Any attacker who registers sys-stdout on PyPI would have their package installed into an environment with active Google Cloud credentials and SA360 data pipeline access.

This PR removes the sys-stdout entry from Pipfile.

@google-cla
Copy link

google-cla bot commented Mar 21, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant