atellaluca/ImportSpy

Verify PyPI package attestations and improve Python supply-chain security

Codeaudit - Modern Python source code security analyzer based on distrust.

Scan Python dependencies for exploited CVEs and abandoned packages that handle untrusted input, ranked by CISA KEV and EPSS. Runs in CI and as a Claude Code hook.

🐍 Scan your Python dependencies for known security vulnerabilities with Rust-powered scanner

Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them

Supply Chain Firewall (SCFW) is a tool for preventing the installation of malicious npm and PyPI packages 🔥

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.

A Python tool to visualize + enforce dependencies, using modular architecture 🌎 Open source 🐍 Installable via pip 🔧 Able to be adopted incrementally - ⚡ Implemented with no runtime impact ♾️ Interoperable with your existing systems 🦀 Written in rust

Output the licenses used by dependencies and check if these are compatible with the project license