You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I noticed that PyG-Library is on PyPi: https://pypi.org/project/pyg-library/ and while it's a little out of date, the install instructions actually reference pyg-lib which is not registered on PyPi. For a project I am on that uses PyG, our security has noticed and complained that this is a sizable security vulnerability.
Could I request claiming pyg-lib on Pypi even if you are not actively publishing there, to prevent supply-side attacks?
Activity
puririshi98 commentedon Jul 27, 2026
i would recommend using the nvidia pyg container which is constantly built on the latest nvidia stack: https://catalog.ngc.nvidia.com/orgs/nvidia/-/containers/pyg/.
coreyjadams commentedon Aug 3, 2026
Thanks! For what it's worth, this is less about access to the latest build and more that the library is leaving users open to vulnerabilities.