Skip to content

pyg-lib is not claimed on PyPi聽#708

Open

Description

@coreyjadams

馃悰 Describe the bug

Hi Pyg-lib team,

I noticed that PyG-Library is on PyPi: https://pypi.org/project/pyg-library/ and while it's a little out of date, the install instructions actually reference pyg-lib which is not registered on PyPi. For a project I am on that uses PyG, our security has noticed and complained that this is a sizable security vulnerability.

Could I request claiming pyg-lib on Pypi even if you are not actively publishing there, to prevent supply-side attacks?

Thanks!
@coreyjadams

Environment

  • pyg-lib version:
  • PyTorch version:
  • OS:
  • Python version:
  • CUDA/cuDNN version:
  • How you installed PyTorch and pyg-lib (conda, pip, source):
  • Any other relevant information:

Activity

  1. puririshi98 commented on Jul 27, 2026

    @puririshi98
    Contributor

    i would recommend using the nvidia pyg container which is constantly built on the latest nvidia stack: https://catalog.ngc.nvidia.com/orgs/nvidia/-/containers/pyg/.

  2. coreyjadams commented on Aug 3, 2026

    @coreyjadams
    Author

    Thanks! For what it's worth, this is less about access to the latest build and more that the library is leaving users open to vulnerabilities.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions