Spot look-alike names and check a hash
difflib finds names that are close to a popular one but not equal to it, the pattern typosquatting relies on. The second half shows why a lock file with hashes protects you: one extra byte gives a different hash, so the file is rejected. This is a teaching sketch, not a replacement for your installer's own checks.
To share a package you build it into a wheel (a ready-to-unpack zip) and an sdist (source archive) with a build backend, then upload both to PyPI, trying TestPyPI first. As a user, treat every dependency as code you are running: pin versions, use hashes, check names and review new packages.
Change the code and press Run (Ctrl+Enter). Predict what will happen first, then break it on purpose and read what changes. Your edits are saved and match the lesson page.
Ready for more? This phase has 5 hands-on exercises with automatic checks.
Practice questions
Write the code in the editor, run it, then open the model answer to compare.
Write the [build-system] table of a pyproject.toml that uses Hatchling as the build backend.
Write a function is_lookalike(name, popular). popular is a list of package names. Return True if name is not in popular but is very close to one of its entries (use difflib.get_close_matches with a cutoff of 0.8). Otherwise return False.
Given the wheel file name numpy-2.0.0-cp313-cp313-manylinux_x86_64.whl, say in plain words what each of the five parts means.
Explain it without notes
What is the difference between a wheel and an sdist?
What does the [build-system] table do?
Why publish to TestPyPI first, and why can't you re-upload the same version?
List practical defences against malicious or compromised packages.
Expected output
requests -> known name
reqeusts -> WARNING: looks like 'requests', check the spelling and the publisher
numpyy -> WARNING: looks like 'numpy', check the spelling and the publisher
left-pad-lite -> unknown name: read its page before installing
same bytes hash matches the lock file: True
tampered bytes hash matches the lock file: False