depsweep

Find supply-chain risks in your npm and pip dependency files.

Most malicious packages don't need you to call them. They run a script the moment you npm install, or they ride in on a name one letter off a package you trust. depsweep reads package.json, requirements.txt, lockfiles and installed node_modules manifests and flags the risks you can see without running anything.

Runs offline. No registry calls, nothing leaves your machine.

Install

pip install depsweep

Usage

depsweep                 scan the current directory
depsweep path            scan a directory
depsweep --min high      only high and critical findings
depsweep --json          machine-readable output

Exit status is 0 when clean, 1 when there is a finding at or above the fail level (--fail-on, default high), and 2 on error.

pre-commit

repos:
  - repo: https://github.com/ReazGan/depsweep
    rev: v0.1.0
    hooks:
      - id: depsweep

GitHub Action

- uses: actions/checkout@v4
- uses: ReazGan/depsweep@v0.1.0

What it checks

A project's own postinstall is not flagged (you wrote it); only dependencies are. Known real packages that happen to sit next to a popular name (tslint, preact, ...) are not reported as typosquats.

Run it after npm install to see dependency install hooks; run it on the repo alone to check manifests and lockfiles.

License

MIT