weird "Yandex Dependency Confusion" plugins

[soxofaan]

https://github.com/pytest-dev/pytest/blob/9c8937b4800c72bb511a45f4548f0c58823ec30b/doc/en/reference/plugin_list.rst lists a couple of plugins with the same description:

   :pypi:`pytest-check-requirements`                A package to prevent Dependency Confusion attacks against Yandex.                                                                                                                                         Feb 10, 2023    N/A                    N/A
   :pypi:`pytest-diffeo`                            A package to prevent Dependency Confusion attacks against Yandex.                                                                                                                                         Feb 10, 2023    N/A                    N/A
   :pypi:`pytest-factor`                            A package to prevent Dependency Confusion attacks against Yandex.                                                                                                                                         Feb 10, 2023    N/A                    N/A
   :pypi:`pytest-star-track-issue`                  A package to prevent Dependency Confusion attacks against Yandex.                                                                                                                                         Feb 10, 2023    N/A                    N/A
   :pypi:`pytest-xskynet`                           A package to prevent Dependency Confusion attacks against Yandex.                                                                                                                                         Feb 10, 2023    N/A                    N/A

each of these links to these strange, minimal pypi listings with

This is a security placeholder package. If you want to claim this name for legitimate purposes, please contact us at ...

Are these legitimate plugins that should be listed in the pytest docs?

[RonnyPfannschmidt]

at first glance they aren't, lets use the descriptions for a filter

[The-Compiler]

IMHO we should not go down the rabbit hole to curate the list. It's just that: An autogenerated list of pytest plugins. It's full of plugins which make no sense for general usage, but that's what it is. If we start excluding things, there's probably a lot more that would make sense to exclude (but where to draw the line?).

If we want a curated plugin list, that should be a different thing. IMHO, #11232 (sorting the list by popularity) is enough of a solution for this.

[nicoddemus]

I agree with @The-Compiler, we probably should focus on sorting the list by popularity/downloads, and only then if we find the need for a curated list, to manually maintain one (and a big IF at that, as I think sorting the list will already provide value enough).

[soxofaan]

If that list is not curated/reviewed, I think there should be a big fat warning on that page about that. Because it is part of the pytest docs I assumed some level of review was involved.
One has to carefully read the leading paragraph on that page to infer that there is no review involved.

[nicoddemus]

@soxofaan would you like to contribute adding a warning to that page then? I guess our initial reasoning was that the paragraph plus the number of plugins would be hint enough that this was not manually maintained, but making that more explicit is certainly good.