When looking for a way to shrink the attack surface for pypi package-typo-squatting, I came across a package called pip-audit on an article on the RedHat blog.
I attempted to use it, but I'm quite confused about how to use it when in different python environments.
The tutorial states that you should create an environment for it, so that makes me think that maybe it just reads
requirements.txt and searches for known CVEs somewhere.
But that kind of doesn't make sense as I suppose some of these package requirements could be recursive...unless it's recursively looking for
requirements.txt or if all of the dependencies are created in the resulting
requirements.txt from running
So, should I change to the
pip-audit environment and then switch to the directory to run the package audit?