sketchydeps

Is anything sketchy installed? One command checks your project's node_modules and Python environment for known malware, typosquats of popular packages, brand-new packages, install scripts that download things, and .pth files that run code every time Python starts.

uvx sketchydeps          # in your project folder

_{Demo: a real Next.js app's node_modules with four entries planted for the demo (just a package.json each, no code). The malware verdicts come live from OSV.}

npm audit and pip-audit tell you about bugs. They don't tell you that the package you installed is loadsh, not lodash. sketchydeps looks at what's actually on disk and asks the questions that matter after every npm worm and PyPI malware wave:

It also lists packages on releases from the last week (where hijacked releases show up first) and counts ordinary vulnerabilities, so you know to run npm audit or pip-audit.

Where it looks

• npm: ./node_modules, including nested and pnpm (.pnpm) layouts. Add --global for globally installed packages.
• Python: ./.venv (or venv, env), else the active $VIRTUAL_ENV, else your python3. Point it elsewhere with --python path/to/venv or --python /usr/bin/python3.12. It reads package metadata from disk and never imports anything.

Options

sketchydeps                      # current folder
sketchydeps path/to/project
sketchydeps --python .venv-ci    # a specific environment
sketchydeps --no-npm             # Python only (or --no-python)
sketchydeps --days 3             # "fresh release" window (default 7)
sketchydeps --all                # include informational findings
sketchydeps --json               # machine-readable
sketchydeps --offline            # install scripts and .pth checks only

Exits with status 1 when it finds malware or a high-severity issue, so you can drop it into CI.

Privacy

Only package names and versions leave your machine: to OSV (malware advisories) and deps.dev (publish dates). The popularity lists are downloaded once and cached for 30 days.

Install

uvx sketchydeps          # run without installing
pipx install sketchydeps # or install it

Requires Python 3.9+. The only dependency is rich.

License

MIT. Popularity data from npm-high-impact (MIT) and top-pypi-packages, fetched at run time.