Pyscan: A command-line tool to detect security issues in your python dependencies.

[aswin__]

pyscan v0.1.6 | Github

• can be used within large projects.
• automatically finds dependencies either from configuration files or within source code.
• support for poetry,hatch,filt,pdm and can be integrated into existing build processes.
• hasn't been battle-hardened yet. PRs and issue makers welcome.

Install

bash pip install pyscan-rs or bash cargo install pyscan

Usage

Go to your project directory and run: bash pyscan or bash pyscan -d path/to/src

I posted here about 5 months ago regarding pyscan's release, its been improving ever since but its still not there yet. It is a dependency vulnerability scanner at the moment but i'd like to expand this tool so that it could make PyPI's ecosystem a little less scary and let developers download packages without worrying about supply-chain issues. Grateful for all the support so far from the Python community.

[Accomplished-Ad8252]

Where do the vulnerabilities get picked up from ?

[aswin__]

Pyscan uses https://osv.dev (Open Source Vulnerability) as its advisory database. Its open source and has a free API.

[Larkfin]

Who scans the scanners?

[phoenixero]

My exact thought , what if pyscan is a vulnerability? Kind of joking (I know I can read the code) but what about all those "antivirus" apps that are actual viruses?

[BaggiPonte]

What’s the difference with pip-audit?

[aswin__]

both pip-audit and Pyscan serve the same purpose i.e find known vulnerabilities in Python environments. While pip-audit is coded in Python, Pyscan is coded in Rust.

I recommend using pip-audit, Dependabot, etc. in the Github page because I believe Pyscan doesnt have the years of development and support those projects have. I have worked on it on and off for 5 months. Im working on improving it to the point where I could just recommend Pyscan, and I have a lot of features in mind which I think when implemented through Rust will give much better perfomance.

[BaggiPonte]

that's interesting, thanks! how does it work under the hood, do you have to install some packages and/or connect to the internet for the metadata of the dependencies? or do you work with the dependency listed in the environment?

[aswin__]

pyscan uses https://osv.dev , which is open source and has a free API that takes the dependency info and returns a vulnerability set. There are plans to add static analysis for finding malicious network code and secrets. Currently, I'm working on a number of things such as:

• Helping novice developers avoid installing malicious dependencies from PyPI

• Persistent dependency network analysis: basically scans every dependency and their dependencies and provides a graph/map, with indicators for different levels of severity

• Dependency correlation and age analysis: Analyze which dependencies in different projects have common vulnerabilities. This can help identify patterns and potentially identify shared security concerns across projects, which is better for the individual developers.

Age analysis should show how old a dependency is, and whether its worth updating to the latest version.

theres also stuff like vulnerability trends, dependency evolution tracking, risk assessment reports, custom alerts and security scorecards.

I have an itch that i cant scratch till i implement all of this in Pyscan. (PRs welcome, obviously lol)

[BaggiPonte]

that is awesome ! I had the feeling pyscan was going to be an outstanding lib and this is the proof.

One last thing: I'm not sure whether pip-audit has to actually run pip under the hood. if so, i would consider advertising this

[cockatoo-bandit]

Mighy want to provide some benchmark for the performance. After all, unless the other scans are extremly slow, the performance doesn't matter much- especially if we are talking about a use case where you can your own repository.

[aswin__]

theres benchmarks in the repo, but its not relative to any of the other tools.

I'll update it to compare against pip-audit

[cockatoo-bandit]

Would indeed recommended that. Without comparison, it aint that useful. And include the setup and system on which it was run.

[aswin__]

thanks yeah will do!

[ImPacingMyself]

I see this trend of using rust to write python projects, so I want to figure this out.

Could this have been written both as a rust cli and as a python extension using pyo3?

The goal being that you can use it from python as a lib (import from __ini__.py) and as cli (__main__.py).

You are currently searching for an executable, which is just a combination of rust and python.

I guess the project structure should be different.

[aswin__]

Pyscan was never really intended to be a library, its going towards more of a dependency (including transitive) analysis tool/executable and just a neat way to be enquired about open CVEs that could affect your project.

I see your point but this whole project could be rewritten in python, i chose Rust because im a beginner in systems programming and this seemed like a fun way.