Any equivalent tools for checking python Requirements?

[TFWol]

It's surprisingly hard to find tools like these when performing a google search.

Results end up leading to the need for creating an account for such and such tool, something that is a nightmare to setup, or long articles that don't really help.

This tool is the answer to npm dependencies.

So any recommendation for Python requirements where you can just point to a list of dependencies and ask 'are any of these bad?'
So far I'm eyeballing dependency-check

[lirantal]

@TFWol thanks for dropping by and welcome :-)

It's surprisingly hard to find tools like these when performing a google search.

I'm curious, what sort of keywords/phrases did you try when searching for this? (also curious how did you end up finding it!)

This tool is the answer to npm dependencies.

🤗

So any recommendation for Python requirements where you can just point to a list of dependencies and ask 'are any of these bad?'
So far I'm eyeballing dependency-check

What specifically are you looking for?
npq is more about being a proactive security (prevention) tool. As in, it should help you find out about issues BEFORE you install dependencies. If you're looking for a tool to tell you "for an existing dependency/requirements.txt what sort of security and package health risks are involved" then I can suggest:

1. Snyk Advisor
2. Snyk via the CLI, GitHub integration or otherwise. See here and here to get started.

Disclaimer: I'm working at Snyk as a developer advocate, and enjoy building appsec tools for developers outside of work too :-)

[TFWol]

I was searching things like

• detect malicious dependencies
• find fake dependencies
• github repo dependency scanner

Where I just wanted something simple that would tell me if a package had typo or something.

Then I saw the keyword "typosquatting" and started using that word which led me to

https://snyk.io/blog/typosquatting-attacks/

Where at the bottom I saw 'npq'

I didn't realize until much later the site had a search that gave me pretty much what I was looking for except I have to paste in one package at a time. Nothing I can do in mass for python yet.

Wish I saw it sooner; the search wasn't all that noticeable to me since I tend to ignore sites that have too much marketing material everywhere. I just think 'trackers' and keep scrolling.

[TFWol]

Ah, didn't see the bottom half of your message; github app sort of hid it.

I was just trying to find quick ways to do a sanity check before installing a chain of software. I sandbox everything, but just in case.

This hit almost too close to home: https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/amp/

Not to mention the other stuff all over the news. "Supply chain this, supply chain that."