lockfile-audit 0.1.0

Scan Python dependency files for known security vulnerabilities across OSV, NVD, and GitHub Advisory Database with EPSS exploit-probability scoring.

lockfile-audit

---

Why lockfile-audit?

pip-audit is a solid tool, but it queries only the PyPA/OSV advisory database — leaving your project blind to CVEs that exist in NVD or the GitHub Advisory Database but haven't yet been cross-referenced in OSV. On top of that, every tool in this space gives you a flat list sorted by CVSS score, which doesn't tell you which vulnerabilities are actually being exploited in the wild right now.

lockfile-audit solves both problems:

1. Broader coverage — queries OSV, NVD, and GitHub Advisory Database in parallel and deduplicates the results into a single unified report.
2. Exploit-probability prioritization — enriches every finding with its EPSS score (probability of exploitation in the next 30 days), so your team can triage a CVSS 9.8 with a 0.1% exploit probability differently from a CVSS 7.5 that is actively being weaponized.

Feature	pip-audit	lockfile-audit
OSV / PyPA database	✅	✅
NVD (NIST) database	❌	✅
GitHub Advisory Database	❌	✅
EPSS exploit-probability scores	❌	✅
SARIF output (GitHub Code Scanning)	❌	✅
Ignore file with expiry enforcement	❌	✅
Async parallel DB queries	❌	✅
requirements.txt parsing	✅	✅
pyproject.toml parsing	✅	✅
poetry.lock parsing	✅	✅

---

Installation

pip: