7 projects
pypi-bulk-download
Bulk-download PyPI packages filtered by popularity (monthly downloads), in parallel, with safe archive unpacking and a JSON manifest. Handy for building research corpora.
tarslip-guard
Detect unsafe tar/zip extractall() calls (CWE-22 tar-slip / zip-slip) and extract archives safely at runtime, with no dependencies.
pypi-version-bisect
Binary-search a PyPI package's release history to find the first-affected, last-affected, and fixed version for a vulnerability.
pypi-blast-radius
Estimate the downstream impact ('blast radius') of a PyPI package version from deps.dev dependent counts and download volume.
osv-dedupe
Score whether a security finding already overlaps a published OSV/NVD advisory for a PyPI package, so scanners can skip known vulnerabilities.
installtime-audit
Audit Python packaging files for install-time side effects (network, exec, credential theft, persistence, dependency confusion) that run during pip install. Complements Bandit.
cvss-estimator
Compute CVSS v3.1 base scores and estimate a full vector from source-to-sink evidence flags — with no runtime dependencies.
