There are a large number of packages (plus some classes) uploaded and updated in CTAN (other mirrors as well). How do the CTAN maintainers make sure the uploaded stuff is free of malicious code? Do they use a sophisticated script (like anti-virus checkers probably use) to parse the code to check for cleanness?

  • 5
    I'm not aware of any check done by the CTAN maintainers. With the default settings TeX is limited in its power to read and write files on the computer and therefore LaTeX packages and classes aren't a big thread. Mar 18, 2013 at 11:18
  • 1
    Moreover, you can disable writing to a greater or lesser extent depending on how paranoid you are.
    – Joseph Wright
    Mar 18, 2013 at 11:20
  • How about packages that need -shell-escape? Do they pass them without any security check? Mar 18, 2013 at 11:27
  • @Karl'sstudents No checks are made on the code, although the occasional loss of a file is picked up by the CTAN guys.
    – Joseph Wright
    Mar 18, 2013 at 12:06
  • 6
    I think a cost-benefit analysis predicts not much to be gained from writing a virus into a LaTeX package or class. First, you limit the susceptible audience to LaTeX users. Then, you need to design a fake package or class (with documentation) that a good portion of users will be tempted into using. Then you have to obscure the actual function within the package's code, which will be visible to all users. So a lot of work for not much impact. Mar 18, 2013 at 12:35

1 Answer 1


we don't apply any checks, since we know of no published "automatic" checks we could apply. most things submitted nowadays are simply too big for a visual check (such as i used to apply in the '90s when i first worked on ctan).

one hopes that people won't run anything with "standard" overwriting controls disabled, and we can't, of course, say anything about "unprotected" behaviour of packages (or anything else, for that matter).

in short caveat emptor...

  • 1
    barbara beeton's writing convention used here, please don't make any capitalization correction. Mar 18, 2013 at 12:31
  • 3
    @Karl'sstudents Can't wasteofspace protect their own publications, did you sign with the wrong username, or am I missing something obvious?
    – user10274
    Mar 18, 2013 at 12:49
  • 1
    @marczellm: Yes. Because she spoke on behalf of her own. Mar 18, 2013 at 15:08
  • 1
    @marczellm: in my understanding or knowledge, she will use lower case for all characters when she talk on behalf of ams. correct me if i am wrong. Mar 18, 2013 at 15:19
  • 1
    @Karl'sstudents To the contrary, as stated at the very end of this TUG interview which I just found.
    – marczellm
    Mar 18, 2013 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.