# Problem spots ## Creating distributions ### Risks #### Vectors - Code injection #### Actors - Build backend - Environment ## Uploading ### Risks #### Vectors - Credential theft - Code injection #### Actors - Environment - Upload tool ## Installing ### Risks #### Vectors - Malicious redirect - Malicious dependency #### Actors - Index - Installer # Mitigations - [[Reproducible builds]] - [Better defaults](https://nesbitt.io/2026/03/31/npms-defaults-are-bad.html) - Opt into using anything other than wheels - Cooldown - Implicitly update lock files - Lock file - Cooldown - Attestations - Trusted Publishing - Staged uploads w/ 2FA - External hash verification - CVEs