
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
gcpipwrap
Advanced tools
A Python wrapper around pip install with support for multiple package indexes and direct URL installs.
--index-url, the rest as --extra-index-urlpip install .
Or with uv:
uv pip install .
Install packages from the default index:
pipwrap requests flask
Install from a private index with a fallback:
pipwrap requests \
--index-url https://private.pypi.org/simple \
--index-url https://pypi.org/simple
The first --index-url becomes the primary index. Any additional --index-url values are passed as --extra-index-url to pip.
Install directly from tar.gz URLs:
pipwrap --from-url https://example.com/packages/foo-1.0.tar.gz
Combine URL installs with custom indexes:
pipwrap --from-url https://example.com/foo-1.0.tar.gz \
--index-url https://private.pypi.org/simple
from pipwrap.installer import PInst
installer = PInst()
# Install packages
installer.install(["requests", "flask"])
# Install with custom indexes
installer.install(
["my-private-pkg"],
index_urls=[
"https://private.pypi.org/simple",
"https://pypi.org/simple",
],
)
# Install from direct URLs
installer.install_from_urls(["https://example.com/foo-1.0.tar.gz"])
All pip commands and their output are logged to a temporary file. To find the log:
from pipwrap.logger import get_log_path
print(get_log_path()) # e.g. /tmp/pipwrap.log
uv sync
uv run pytest -q
uv run ruff check .
MIT
FAQs
Wrapper around pip with multi-index and URL install support
We found that gcpipwrap demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.