Repository navigation
Pip install command does not match the documentation #151
Description
The About section on the frontpage links to pythonhosted.org/fitparse/.
That documentation is telling the user to run
$ pip install python-fitparse
which does not match the front page
$ pip install fitparse
This is especially concerning, given that there is a 0-star repository reusing the name:
https://github.com/nbr23/python-fitparse
I would understand if it was a fork of this but it is not. It looks like a re-uploaded version of this repo which hides forking information, and despite the new user's commits from July 19, 2025 onwards, their readme remains not updated, it still has David's message about it not being maintained. OTOH it also has the pip install fitparse message.
That author also has their own repo on PyPI https://pypi.org/project/python-fitparse/
While their code did not show any scripts or malicious code, this situation needs to be resolved ASAP, as it is a dependency confusion attack vector.
Activity
update readme to make clear this is a fork and not the original
nbr23 commentedon Feb 13, 2026
hi @maqp,
thanks, I've updated the readme for https://github.com/nbr23/python-fitparse to hopefully clarify my repo's situation, which is:
Cheers
maqp commentedon Feb 14, 2026
@nbr23 Awesome thanks for a speedy response! I think you've done all that's necessary. All that's left to do is have this repository update its documentation to point to the correct package and perhaps to your fork. Thanks for keeping the library alive :)