4 projects
pypi-blast-radius
Estimate the downstream impact ('blast radius') of a PyPI package version from deps.dev dependent counts and download volume.
osv-dedupe
Score whether a security finding already overlaps a published OSV/NVD advisory for a PyPI package, so scanners can skip known vulnerabilities.
installtime-audit
Audit Python packaging files for install-time side effects (network, exec, credential theft, persistence, dependency confusion) that run during pip install. Complements Bandit.
cvss-estimator
Compute CVSS v3.1 base scores and estimate a full vector from source-to-sink evidence flags — with no runtime dependencies.
