Supply chain security for Python

Stop
malicious
packages.

pipguard intercepts every pip install and runs a two-layer analysis — trust signals + AST static analysis — before anything touches your system.

$ pip install pipguard-cli

PyPI + GitHub repos

Zero execution — AST only

24-hour cache for instant repeats

Live example

Caught before it ran.

A package with no GitHub repo, 12 days old, with network request and env var access in its setup code. pipguard blocks it and asks before anything installs.

terminal

$ pip install git+https://github.com/psf/requests

Analyzing git+https://github.com/psf/requests...

──────── TRUST SCORE ────────

Repo age5550d ✅

Stars53925 ✅

Contributors120 ✅

Known vulns2 found 🔴

──────── CODE ANALYSIS ──────

Network requestsnot found ✅

Env var accessnot found ✅

Shell executionnot found ✅

Base64 obfuscationnot found ✅

✅ LOW RISK Score: 100

Installing git+https://github.com/psf/requests...

GitHub repositories

Analyze direct GitHub installs.

pipguard now fully analyzes Python packages installed directly from GitHub. Repository age, stars, contributor count, license, and last commit time all feed into the risk score — same as PyPI packages.

How it works

Two layers. Zero execution.

Layer 1 — No download required

Trust signals

PyPI: age, versions, download spikes
GitHub: repo age, stars, contributors
Known CVEs via OSV.dev
License presence (GitHub)
Last commit & activity

Layer 2 — AST-based, no code runs

Static analysis

Parses setup.py, __init__.py, pyproject.toml
Detects network calls and env var access
Catches shell execution and home dir access
Flags base64 obfuscation
Works for both PyPI and GitHub sources

Key features

Everything built in.

✓

PyPI + GitHub

Dual source support

Analyze PyPI packages by name
Analyze direct GitHub installs
Works with git+https:// URLs
Branch-specific analysis support

✓

DevOps Ready

CI/CD integration

--ci mode for pipelines
Exit codes for automation
--fail-on medium|high
Batch scan requirements files

✓

Performance

24-hour smart cache

Instant repeat installs
Local cache at ~/.pipguard/
--no-cache for fresh checks
Force clear with update --force

✓

Rich Commands

CLI toolkit

install — analyze & install
info — report only, no install
scan — batch requirements.txt
history — recent scans

Comparison

vs. existing tools

Feature	pip audit	socket.dev	Dependabot	pipguard
At install interception	✗	✗	✗	✓
Analyzes PyPI packages	✓	✓	✓	✓
Analyzes GitHub repos	✗	✗	✗	✓
AST code analysis	✗	✓	✗	✓
CLI integration	✓	✗ web only	✗ GitHub only	✓
24-hour cache	✗	✗	✗	✓
CI/CD ready	✓	Limited	✓	✓

Stop malicious packages.