Open Source Security Tool

depsec

AI-powered security scanning for Python packages

Catch typosquatting, malicious code, and supply chain attacks before they reach your environment.

Terminal
$ depsec install flask requests
Resolving 12 packages...

Analyzing flask (3.0.0) ✓ Safe
Analyzing requests (2.31.0) ✓ Safe
Analyzing jinja2 (3.1.2) ✓ Safe
Analyzing reqeusts (1.0.0) ✗ Blocked — Typosquat of 'requests' (distance: 2)
  → Setup.py contains: subprocess.Popen, base64.b64decode

11 packages safe · 0 warnings · 1 blocked
Get Started View on GitHub

Three layers of protection

depsec sits between you and pip, analyzing every package before it touches your system.

1

Resolve

Uses pip's dependency resolver to map the full dependency tree, catching every transitive dependency.

2

Analyze

3-tier analysis pipeline: heuristic checks, AST scanning of source code, then AI review for flagged packages.

3

Install

Only installs packages that pass all security checks. Blocked packages are reported, never installed.

Comprehensive threat detection

From simple typos to sophisticated supply chain attacks, depsec has you covered.

🔎

Typosquatting

Detects packages with names similar to popular packages, like reqeusts vs requests.

⚠️

Malicious Code

AST analysis flags suspicious patterns in setup.py: exec(), eval(), subprocess calls, and network access.

📚

Known Vulnerabilities

Queries the OSV database for known CVEs affecting the package and its resolved version.

🚫

Obfuscation

Detects base64 encoding, eval chains, and other techniques used to hide malicious behavior.

🔗

Supply Chain Signals

Flags brand-new packages, packages with no homepage, and single-maintainer projects.

AI-Powered Code Review

When a package gets flagged by heuristics or AST scanning, depsec sends the relevant code to an LLM for deeper analysis. The AI reviews the code for patterns that rule-based systems miss.

Not every package triggers AI review — only those that raise initial suspicion. This keeps scans fast while ensuring thorough analysis where it matters.

Data Exfiltration Reverse Shells Credential Theft Crypto Mining Backdoors DNS Tunneling

Up and running in seconds

Install depsec and start scanning. Drop-in replacement for pip install.

# Install depsec $ pip install depsec   # Scan and install packages $ depsec install flask requests   # Audit an existing requirements file $ depsec audit -r requirements.txt
View Documentation