PRP: Extractor for IPython "Magic" Installs

[micrictor]

• Software distribution method or binary type: IPython "magic" inline installation of PyPi/Conda packages.

• Popularity of distribution method

IPython notebooks (ipynb) are a part of massively adopted products like Google Colab and Jupyter.

A GitHub search shows >160k references to this method of installing libraries. A Scalibr scan on these repositories without this extractor fails to identify that the notebooks are fetching and installing the referenced packages at runtime.

https://github.com/search?q=%28%22%25pip+install%22+OR+%22%25conda+install%22+OR+%22%25uv+install%22+%29+AND+%28path%3A*.ipynb+OR+language%3APython%29&type=code

• Any critical, emergent vulnerability associated with software from the distribution method:

The supply chain risks are the same as for the existing Python extractors.

• Resources:
  • IPython "magics" for inline installation of packages

[github-actions]

Welcome to the OSV-SCALIBR patch reward program!
Your issue has been added to our triage queue and will reviewed
shortly. The panel usually takes a decision once per week, so it
can take up to a week before you hear back from us, sometimes longer
depending on available capacity.
Please, do not start the work until the panel has reached a
decision. Although we always welcome contributions, unapproved
work is not eligible for a reward.
~The OSV-SCALIBR PRP team