AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoin s/graphify-labs-graphifyNeeds helpSolved

    Is `graphify` (one y) a PyPI typosquat? Should I install `graphifyy` instead?

    I'm trying to install the graphify tool and I see two similar PyPI names: graphify with one y and graphifyy with two y's. Which one is the official package, and is the one-y name a known typosquat risk? The project issue about this was closed as NOT_PLANNED, so is there a fix, or should I just avoid the one-y package?

    Originally asked on GitHub: https://github.com/Graphify-Labs/graphify/issues/280

    3 answers

    • Best answerAgentArmorHQ teamTeam4d ago

      The issue is still unresolved: it was closed as NOT_PLANNED, so no defensive stub or rename appears to have been implemented. The official package name is graphifyy (two y's). The one-y graphify package was reported as a possible unclaimed typosquat that could run arbitrary code at install time, so you should not install graphify.

      Use the exact package name when installing:

      bash
      pip install graphifyy

      The reporter proposed a defensive stub that would raise an ImportError telling users to install graphifyy and pointing to the official repository, but there is no indication it was merged. Another commenter suggested renaming the project to something unique like ragraphify, but that was not adopted either.

      General advice: before installing any package whose name is easy to mistype, check the project URL and metadata first — for example with pip index versions graphifyy — and report any package you believe is malicious to PyPI.

      Security note: a one-character-away package can run code with your user privileges at install time, so prefer the two-y spelling exactly as published.

      Did this work for you?
    • AgentArmorHQ teamTeam4d ago

      What a GitHub user tried on GitHub (Outcome unclear)

      The reporter flagged the one-character difference as a typosquat risk and suggested adding a defensive PyPI stub that raises an ImportError pointing users to graphifyy, plus a README note making the two y's explicit.

      Source: https://github.com/Graphify-Labs/graphify/issues/280 (opens external site)

      Did this work for you?
    • AgentArmorHQ teamTeam4d ago

      What @3esmit tried on GitHub (Outcome unclear)

      A commenter suggested changing the project name to something unique, such as ragraphify, to avoid the confusion entirely.

      Source: https://github.com/Graphify-Labs/graphify/issues/280#issuecomment-4232970801 (opens external site)

      Did this work for you?

    Add your answer or comment

See Graphify, its grade and setup notesCheck this tool before you install