Python Security Risks: Unsafe Use of Download Folders, $PYTHONPATH, and pip

Python has become one of the world’s most popular programming languages because its concise syntax lets you run a script simply by placing it in a .py file and executing it.

While this ease of use is great for beginners—e.g., importing a custom module with a single import my_lib line—it also opens a backdoor for attackers who can place malicious code in locations that Python automatically trusts.

Safe execution of a Python program requires three conditions: every entry on the system path must be in a safe location; the directory of the "main script" must always be on the system path; and when using the -c or -m options, the calling directory must also be safe.

For example, if a user downloads a file named pip.py into ~/Downloads and then runs python -m pip install ./totally‑legit‑package.whl , the malicious pip.py can replace the real pip command and execute arbitrary code, as shown by the following terminal session: ~$ cd Downloads<br/>~/Downloads$ python -m pip install ./totally‑legit‑package.whl

Similarly, an incorrectly set $PYTHONPATH can cause Python to import modules from unintended directories. The article demonstrates this with commands such as: export PYTHONPATH="/a/perfectly/safe/place:$PYTHONPATH"; python ../install_dir/tool.py which results in the malicious module being loaded and printing "lol ur pwnt".

Setting $PYTHONPATH to an empty string is not the same as unsetting it; Python treats an empty string as a valid path entry (the current directory), allowing attackers to inject code. The correct way is to unset PYTHONPATH or use virtual environments, which isolate dependencies without relying on $PYTHONPATH .

To modify $PYTHONPATH safely, the article suggests appending new entries only when the variable is already defined, e.g.: export PYTHONPATH="${PYTHONPATH:+${PYTHONPATH}:}new_entry_1"<br/>export PYTHONPATH="${PYTHONPATH:+${PYTHONPATH}:}new_entry_2"

Finally, the article summarizes preventive measures: always invoke pip via the virtual‑environment binary (e.g., /path/to/venv/bin/pip ) instead of python -m pip ; avoid using ~/Downloads as the current working directory; keep $PYTHONPATH clean or unset it; and prefer absolute paths when the variable is necessary.