Yes. Pip turns any command line option into an environment variable named PIP_ followed by the upper case option name, and the documentation says environment variables override its configuration files. A stray variable in your shell profile can therefore point installs at a different index without any change to the command you type.
How pip decides its settings
The pip configuration page lists three mechanisms: command line options, environment variables, and configuration files. The files come in three levels:
- Global, a system wide file shared across users.
- User, a per-user file.
- Site, a per-environment file, meaning per virtual environment or Python installation.
Environment variables, the page says, will override any of the files. The format is PIP_ plus the long option name in upper case, with dashes replaced by underscores. The page gives PIP_TIMEOUT set to 60 as equal to passing the timeout option.
That same rule applies to options that choose package sources. If an option exists to name an index or extra links, a matching variable can set it too.
Why this matters on a laptop
Consider where environment variables come from: shell profile files, dotfiles repositories, setup scripts, a tool installer that edits your profile, a copied snippet from a forum. Each is a way for a setting to arrive that you did not type today.
If a variable sends pip to an unexpected source, you can install a package of the right name from the wrong place. This is the same class of risk we describe in pip extra index versus first index. Because the command looks normal, it is easy to miss.
Five minute check
env | grep -i '^PIP_'
python -m pip config list
python -m pip config debug
The first line prints any PIP_ variables in your session. The config list command shows the values pip resolved. The debug command shows which files pip considered. Compare the output with what you expect from your team's setup documentation.
Then check the three config file levels. The pip page gives the locations per operating system, and notes extra complexity where legacy and current user locations both exist.
Make it a standing control
- Keep your team's intended index settings in one documented place.
- Review profile files and dotfiles when onboarding a new laptop.
- In CI, print the resolved configuration at the start of a job so an unexpected source shows up in logs.
- Prefer lockfiles with hashes, which fail loudly if content differs.
- Treat a new PIP_ variable in a pull request or setup script as a review item.
npm has a similar pattern: variables starting with npm_config_ become configuration parameters. We cover it in the four places npm reads config.
Quick check
Which wins, an environment variable or a config file?
Per the pip documentation, environment variables override the configuration files.
How do I see which settings pip is using?
Run python -m pip config list, and python -m pip config debug to see the files it checked.
Sources
Last reviewed: 19 October 2026.
