dependency-confusion
Assess a Python package for supply-chain risk before pip installs it. Pre-install gate for pip with sandbox-backed verdicts, SARIF output and CI exit codes.
Static supply-chain checks for npm and PyPI packages, lockfiles, provenance, and known malware.
This package implements a test for Dependency Confusion using pip.
## Auto-archived due to inactivity. ## Yorkshire is your friend, yorkshire checks Python's requirements files for a possible dependency confusion.
