Show HN: An OSS Python dependency scanner for exploited, unmaintained packages

Show HN: An OSS Python dependency scanner for exploited, unmaintained packages github.com

Scan Python dependencies for exploited CVEs and abandoned packages that handle untrusted input, ranked by CISA KEV and EPSS. Runs in CI and as a Claude Code hook. - binuka200/package-doctor

4 points•binukajayaweera•12 days ago•5 comments•

#packages #python #exploited #scanner #dependency #unmaintained #dependency scanner #python dependency

I built an open source python dependency scanner that will scan and flag packages with known exploit CVEs(CISA's Known Exploited list and FIRST EPSS) and unmaintained packages that have not had a release or commit in 2 years. Theres also claude hook that will make your AI agent not install these type of packages included in this repo. The full mechanism is in the readme of the project, this was just a brief summary.

5 comments

binukajayaweera12 days ago

the packages get flagged or escalated if its at a trust boundary for example if it parses, decodes or authenticates data that an attacker can influence and have either a known CVE or is basically unmaintained. Non trust boundary packages also get reported but not escalated. I welcome contributions to the repo to make it more useful. More info can be found in the readme and docs attached to it.

zahlman12 days ago

Have you considered talking to PyPI staff about this?

binukajayaweera11 days ago

I dont know how I can reach them, I would love to get their feedback on this

zahlman11 days ago

There's a public Python packaging Discord https://discord.gg/pypa , or you can try emailing the Packaging Work Group (see info at https://wiki.python.org/psf/PackagingWG ), although the latter is probably deprecated. You can also try the Packaging section of the official Python forums: https://discuss.python.org/c/packaging/14

Read the full thread on Hacker News →

5 comments

Related stories