pypi-blast-radius

Estimate the downstream impact of a specific PyPI package version — how many other projects would be affected if it had a vulnerability. It combines deps.dev direct/indirect dependent counts with an optional monthly-download figure into a single, conservative impact proxy you can use to rank findings.

The proxy is ranking evidence, not a precise affected-install count. PyPI does not expose reliable reverse-dependent download totals, so any such number is an estimate.

Install

pip install pypi-blast-radius

Library usage

from pypi_blast_radius import estimate_blast_radius

result = estimate_blast_radius("requests", "2.31.0", direct_downloads=1_000_000)
print(result["direct_dependent_count"])         # from deps.dev
print(result["indirect_dependent_count"])       # from deps.dev
print(result["estimated_transitive_downloads"]) # bounded proxy
print(result["total_impact_score"])             # downloads + proxy

If deps.dev has no data for the version, or inputs are missing, an empty dict is returned (never an exception).

CLI

pypi-blast-radius requests 2.31.0 --downloads 1000000
pypi-blast-radius requests 2.31.0 --json

How the proxy works

• direct_dependent_count and indirect_dependent_count come straight from deps.dev.
• estimated_transitive_downloads = direct_downloads * min(10, log1p(direct + 0.2*indirect) * 0.9) — indirect dependents are weighted lower, and the multiplier is capped at 10x so a huge dependent graph can't produce an absurd number.
• Results are cached in-process; call clear_cache() to reset.

License

MIT