I released repowise on PyPI, a tool that builds and maintains a codebase wiki and provides Git-based insights such as hotspots and ownership. Shortly afterward, three packages appeared with nearly identical descriptions claiming to outperform repowise. After inspecting them, I found substantial portions of my AGPL-3.0 code, apparently modified with an LLM and republished without the required attribution, license text, or source link. I reported the packages through PyPI's abuse process, submitted a copyright complaint, and contacted the Python Software Foundation's legal address, but received no response for several weeks. What practical steps can I take to document and enforce the violation, especially since hiring a lawyer or filing a lawsuit is not currently realistic?
4 Answers
You could also contact the package maintainers directly with a concise request to remove the packages or bring them into compliance. They may genuinely not understand the AGPL requirements, and compliance would generally mean retaining copyright notices, including the license, identifying the source, and meeting the corresponding-source obligations. Keep the communication professional and preserve the messages in case you need them later.
Send a formal DMCA notice rather than a general complaint. Include the affected package names and URLs, identify the original work, provide a side-by-side comparison, explain that the copied code is distributed without the AGPL notices or source information, and include the required contact and good-faith statements. The standard process may involve forwarding your notice to the package owners, who can contest it. This is a copyright procedure, not a mechanism for PyPI to decide every license dispute, so keep your expectations realistic.
I previously emailed the legal address with the evidence, but it was not formatted as a formal DMCA notice. I’m going to resend it using a proper template and include all of the required details.
Preserve as much evidence as possible before anything changes: archived package files, timestamps, download counts, repository history, removed headers, missing license files, and diffs showing copied sections. If the code is hosted on a source-control platform, submit a separate copyright complaint there as well. A clear evidence packet is more useful than simply saying that the packages are forks.
A registry usually won’t act as a court or determine every disputed license claim, and response times can be slow when abuse reports increase. Three identical packages may be intended to crowd out the original in search results, but that’s difficult to prove. If the formal notice does not resolve it, a copyright or open-source licensing lawyer is the appropriate next step, even if that means first looking for a short consultation or a legal clinic. Avoid relying on public callouts as your main enforcement strategy.
I found links from one of the package pages to the maintainers’ project profiles and plan to ask them to take the packages down before escalating further.