Metadata-Version: 2.5
Name: sketchydeps
Version: 0.1.0
Summary: Is anything sketchy installed? Checks your Python env and node_modules for typosquats, known malware, brand-new releases, install scripts and .pth tricks.
Project-URL: Homepage, https://github.com/ArkaKhorchidian/sketchydeps
Project-URL: Issues, https://github.com/ArkaKhorchidian/sketchydeps/issues
Author: Arka Khorchidian
License-Expression: MIT
License-File: LICENSE
Keywords: cli,dependencies,devsecops,malware,npm,osv,pypi,security,supply-chain,typosquatting
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Classifier: Topic :: Utilities
Requires-Python: >=3.9
Requires-Dist: rich>=13
Provides-Extra: test
Requires-Dist: pytest>=7; extra == 'test'
Description-Content-Type: text/markdown

# sketchydeps

**Is anything sketchy installed?** One command checks your project's `node_modules` and Python environment for known malware, typosquats of popular packages, brand-new packages, install scripts that download things, and `.pth` files that run code every time Python starts.

```bash
uvx sketchydeps          # in your project folder
```

<p align="center"><img src="https://raw.githubusercontent.com/ArkaKhorchidian/sketchydeps/main/docs/demo.gif" alt="sketchydeps demo" width="760"></p>

<sub>Demo: a real Next.js app's <code>node_modules</code> with four entries planted for the demo (just a <code>package.json</code> each, no code). The malware verdicts come live from OSV.</sub>

`npm audit` and `pip-audit` tell you about bugs. They don't tell you that the package you installed is `loadsh`, not `lodash`. sketchydeps looks at **what's actually on disk** and asks the questions that matter after every npm worm and PyPI malware wave:

| Check | Flags | Data |
|---|---|---|
| **Known malware** | Installed versions reported as malicious (`MAL-` entries from the OpenSSF malicious-packages feed, GitHub malware advisories) | [OSV.dev](https://osv.dev) |
| **Typosquats** | Names one keystroke from a top-5,000 package (`reqeusts`, `loadsh`), or the same name with look-alike characters (`djang0`, `py-yaml`) | Download rankings for [PyPI](https://github.com/hugovk/top-pypi-packages) and [npm](https://github.com/wooorm/npm-high-impact) |
| **Brand-new packages** | Packages that first appeared on the registry in the last 30 days | [deps.dev](https://deps.dev) |
| **Install scripts** | `preinstall` / `install` / `postinstall` hooks that fetch URLs, pipe to a shell, `eval` or decode base64. Ordinary ones (`node-gyp rebuild`, `prebuild-install`, husky) are counted, not flagged | `package.json` in `node_modules` |
| **Start-up code** | `.pth` files in site-packages that run code every time Python starts, a trick used by real PyPI malware. setuptools' own shim and namespace packages are ignored | site-packages |
| **Not on the registry** | Installed packages the public registry has never heard of: private, local, or removed (removals are often malware takedowns). Shown with `--all` | deps.dev |

It also lists packages on releases from the last week (where hijacked releases show up first) and counts ordinary vulnerabilities, so you know to run `npm audit` or `pip-audit`.

## Where it looks

- **npm**: `./node_modules`, including nested and pnpm (`.pnpm`) layouts. Add `--global` for globally installed packages.
- **Python**: `./.venv` (or `venv`, `env`), else the active `$VIRTUAL_ENV`, else your `python3`. Point it elsewhere with `--python path/to/venv` or `--python /usr/bin/python3.12`. It reads package metadata from disk and never imports anything.

## Options

```
sketchydeps                      # current folder
sketchydeps path/to/project
sketchydeps --python .venv-ci    # a specific environment
sketchydeps --no-npm             # Python only (or --no-python)
sketchydeps --days 3             # "fresh release" window (default 7)
sketchydeps --all                # include informational findings
sketchydeps --json               # machine-readable
sketchydeps --offline            # install scripts and .pth checks only
```

Exits with status 1 when it finds malware or a high-severity issue, so you can drop it into CI.

## Privacy

Only package names and versions leave your machine: to OSV (malware advisories) and deps.dev (publish dates). The popularity lists are downloaded once and cached for 30 days.

## Install

```bash
uvx sketchydeps          # run without installing
pipx install sketchydeps # or install it
```

Requires Python 3.9+. The only dependency is `rich`.

## License

MIT. Popularity data from [npm-high-impact](https://github.com/wooorm/npm-high-impact) (MIT) and [top-pypi-packages](https://github.com/hugovk/top-pypi-packages), fetched at run time.
