installtime-audit

Audit Python packaging files for install-time side effects — code that runs during pip install and that malicious packages abuse to phone home, steal credentials, or establish persistence. It's the supply-chain gap Bandit doesn't specifically target.

Code at module scope in setup.py (and build.py, hatch_build.py, …), or inside a build hook like setup() / install.run(), executes on install. installtime-audit statically flags dangerous operations reachable at that point — without importing or running any of the target code.

Install

pip install installtime-audit

What it flags

Helper functions that the build system never calls are not flagged, to keep noise low — only module scope and known hooks count as reachable.

Library usage

from installtime_audit import scan_source, scan_path

for f in scan_source(open("setup.py").read(), filename="setup.py"):
    print(f)   # setup.py:12: [vuln] INSTALL-NET-EXEC (494) ...

# Or scan a whole unpacked package
findings = scan_path("./unpacked_package/")

CLI

installtime-audit ./unpacked_package/
installtime-audit setup.py requirements.txt --json

Exit code is non-zero when a vuln-kind finding exists (tune with --fail-on any|vuln|never), so it drops into CI easily.

Caveats

This is a heuristic linter for triage, not proof of maliciousness. Legitimate packages sometimes compile extensions or fetch data at build time; review each finding in context.

License

MIT