TeX - LaTeX Stack Exchange is a question and answer site for users of TeX, LaTeX, ConTeXt, and related typesetting systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are a large number of packages (plus some classes) uploaded and updated in CTAN (other mirrors as well). How do the CTAN maintainers make sure the uploaded stuff is free of malicious code? Do they use a sophisticated script (like anti-virus checkers probably use) to parse the code to check for cleanness?

share|improve this question
I'm not aware of any check done by the CTAN maintainers. With the default settings TeX is limited in its power to read and write files on the computer and therefore LaTeX packages and classes aren't a big thread. – Martin Scharrer Mar 18 '13 at 11:18
Moreover, you can disable writing to a greater or lesser extent depending on how paranoid you are. – Joseph Wright Mar 18 '13 at 11:20
How about packages that need -shell-escape? Do they pass them without any security check? – kiss my armpit Mar 18 '13 at 11:27
@Karl'sstudents No checks are made on the code, although the occasional loss of a file is picked up by the CTAN guys. – Joseph Wright Mar 18 '13 at 12:06
I think a cost-benefit analysis predicts not much to be gained from writing a virus into a LaTeX package or class. First, you limit the susceptible audience to LaTeX users. Then, you need to design a fake package or class (with documentation) that a good portion of users will be tempted into using. Then you have to obscure the actual function within the package's code, which will be visible to all users. So a lot of work for not much impact. – Matthew Leingang Mar 18 '13 at 12:35
up vote 18 down vote accepted

we don't apply any checks, since we know of no published "automatic" checks we could apply. most things submitted nowadays are simply too big for a visual check (such as i used to apply in the '90s when i first worked on ctan).

one hopes that people won't run anything with "standard" overwriting controls disabled, and we can't, of course, say anything about "unprotected" behaviour of packages (or anything else, for that matter).

in short caveat emptor...

share|improve this answer
barbara beeton's writing convention used here, please don't make any capitalization correction. – kiss my armpit Mar 18 '13 at 12:31
@Karl'sstudents Can't wasteofspace protect their own publications, did you sign with the wrong username, or am I missing something obvious? – Marc van Dongen Mar 18 '13 at 12:49
@MarcvanDongen: I signed it by reading the context in which he/she talked with the word "We" rather than "I". – kiss my armpit Mar 18 '13 at 13:05
@marczellm: Yes. Because she spoke on behalf of her own. – kiss my armpit Mar 18 '13 at 15:08
@marczellm: in my understanding or knowledge, she will use lower case for all characters when she talk on behalf of ams. correct me if i am wrong. – kiss my armpit Mar 18 '13 at 15:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.