I just read this article which showed that more than 400 Python packages from PyPI are fake versions of the original, the only difference their package name and obviously the malicious payload: Phylum Discovers Revived Crypto Wallet Address Replacement Attack

Since I use Python extensively for rapid prototyping, I wanted to quickly check if I’m affected.

So I - partially manually - extracted the list of affected packages from the website and put it into a file named bad-python-packages.txt (uploaded for your convenience, but compare yourself against the original source).

Next, grab the list of currently installed packages:

$ pip3 list installed | tail -n+3 | awk '{print $1}' > installed

And run a totally ineffective grep-loop over it:

$ for i in $(cat bad-python-packages.txt); do grep "^$i$" installed ; done
$

No output, so not affected, yay!