abacker 发表于 2026-9-15 11:43

python依赖报毒

自己的项目安装python依赖时报毒, 大概率误报, 不过还是检查一下安全, 万一源头被投毒呢, {:15_450:}

name = "
version = "0.1.0"
description = ""
readme = "README.md"
license = "Apache-2.0"
license-files = ["LICENSE"]
authors = [{ name = "" }]
requires-python = ">=3.12"
keywords = ["qbittorrent", "private-tracker", "torrent", "automation", "seeding"]
classifiers = [
    "Development Status :: 4 - Beta",
    "Environment :: Console",
    "Environment :: X11 Applications",
    "Intended Audience :: End Users/Desktop",
    "Operating System :: Microsoft :: Windows",
    "Operating System :: POSIX :: Linux",
    "Operating System :: MacOS",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Topic :: Communications :: File Sharing",
    "Topic :: Utilities",
]

# 直接依赖: 精确锁定 (uv.lock 会锁全量传递依赖; 升级时改这里再 `uv lock --upgrade`)
dependencies = [
    "pyyaml==6.0.3",
    "qbittorrent-api==2026.8.1",
    "filelock==3.32.6",
    "pystray==0.19.5",
    "pillow==12.3.0",
    "customtkinter==6.0.0",
    "fastapi==0.141.1",
    "uvicorn==0.53.0",
    "ruamel.yaml==0.19.1",
    "httpx==0.28.1",
]


auto-qb = "auto_qb.cli:main"

# 开发/测试依赖 (PEP 735 依赖组, 取代 .github/workflows/requirements-dev.txt 的 dev 部分)

dev = [
    "pytest==9.1.1",
    "pytest-cov==7.1.0",
]


requires = ["hatchling"]
build-backend = "hatchling.build"


packages = ["src/auto_qb"]


abacker 发表于 2026-9-15 11:52

顺便提一下, python venv 执行 pytest 时会警告:
进程:C:\Users\11059\AppData\Local\Programs\Python\Python312\python.exe
动作:创建文件链接
路径:C:\TEMP\pytest-of-11059\pytest-590
风险文件:D:\Projects\auto-qb-autoclaw\.venv\Scripts\pytest.exe
全部允许
拦截补充描述:程序正在创建文件链接,会绕过安全软件的文件防护。如果不是您主动创建,请阻止。

防护信息: AD|59, 720|30, 30, -1||

leo0205 发表于 2026-9-15 13:59

您好,您直接打包,上传到我们开放平台,让我们技术协助您看下:https://open.soft.360.cn/report.php
页: [1]
查看完整版本: python依赖报毒