PyPI Reports on Inbound Malware Notices

How many inbound malware reports do we receive? How long does it take for a response from an administrator to remove the reported malware? Dustin Ingram January 4, 2023 What is the frequency of inbound malware reports? We have received anecdotal evidence from reporters that PyPI admins are already quite fast at handling inbound reports, but let's see if we can get data out of the same emails. Inbound reports come in at any time of day, and can also be automatically generated by reporters. On occasion an inbound report may get overlooked, something we're trying to solve with a new system, more on this later. Part of the PyPI Malware Reporting and Response project is to explore ways to decrease the response times even further, while reducing the toil on maintainers, and increasing visibility to reporters. We can now happily report that 80% all reports are responded to within 60 minutes of receipt, with 100% are responded to within 12 hours.