Pip Audit Python Packages

ca9

CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.

package-doctor

Scan Python dependencies for exploited CVEs and abandoned packages that handle untrusted input, ranked by CISA KEV and EPSS. Runs in CI and as a Claude Code hook.

lintorn

Vérifie que ta doc et la mémoire de ton IA disent encore la vérité sur ton code.

venvy

Offline, machine-wide Python supply-chain security audit - scan every virtual environment for vulnerable & malicious packages. CVE + typosquat detection, agent/CI-ready JSON. Also a lightweight venv manager.

pipguard

Block the attack before it lands.

yyds-pip-audit

⚡ Super-fast & precise Python dependency auditor. Statically extracts imports (AST), maps imports to PyPI names (e.g. cv2 -> opencv-python) via env metadata, and cross-checks requirements.txt for missing or unused packages in seconds. 极速且精准的 Python 依赖审计工具。静态解析提取代码导入（AST 语法树），结合环境元数据自动将导入名映射为 PyPI 包名（如将 cv2 映射为 opencv-python）并在数秒内对比校验,以揪出缺失或未使用的依赖包

sarif-kit

Convert the native output of scanners and linters that never added SARIF support into valid SARIF 2.1.0 for GitHub Code Scanning