Metadata-Version: 2.4
Name: pipguard-security
Version: 0.1.2
Summary: A security tool to prevent accidental installation of malicious AI-generated packages
License: MIT
Author: PipGuard Team
Requires-Python: >=3.9,<4.0
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Requires-Dist: httpx (>=0.28.0,<0.29.0)
Requires-Dist: rapidfuzz (>=3.14.0,<4.0.0)
Requires-Dist: requests (>=2.33.0,<3.0.0)
Requires-Dist: rich (>=15.0.0,<16.0.0)
Requires-Dist: typer (>=0.25.0,<0.26.0)
Description-Content-Type: text/markdown

# PipGuard

A security tool to prevent accidental installation of malicious AI-generated packages.

## Problem

AI coding assistants (ChatGPT, Claude, Copilot) sometimes invent nonexistent Python packages. Developers might unknowingly run `pip install` on these hallucinated names, installing malware or typosquat packages that can compromise development environments.

## Solution

PipGuard intercepts package installations and provides real-time risk assessment:

- **Typosquatting detection** - Identifies packages mimicking popular libraries
- **Malicious package database** - Checks against known malicious packages from OSV, GitHub Advisory Database
- **Suspicious pattern detection** - Flags new packages with low download counts, obfuscated code
- **Warn-by-default approach** - Never blocks workflows, builds trust through informative warnings

## Installation

```bash
pip install pipguard
```

## Usage

```bash
# Install a package with safety check
pipguard install requests

# Scan requirements file
pipguard scan requirements.txt

# Audit current environment
pipguard audit .
```

## Risk Assessment

PipGuard analyzes packages for:

- **HIGH**: Known malicious packages or clear typosquats
- **MEDIUM**: Suspicious patterns (new package, low downloads, suspicious metadata)
- **LOW**: Minor concerns worth noting

Example warning:
```
⚠️  Suspicious package detected: "reqeusts"
Reasons:
- Similar to popular package "requests"
- Published 2 days ago
- Low download count
Risk score: HIGH

Continue anyway? (y/N)
```

## Data Sources

- [OpenSSF Malicious Packages](https://github.com/ossf/malicious-packages)
- [PyPA Advisory Database](https://github.com/pypa/advisory-database)
- [OSV.dev](https://osv.dev/)
- [PyPI JSON API](https://pypi.org/pypi/json)

## License

MIT License - see [LICENSE](LICENSE) file for details.

