When looking for a way to shrink the attack surface for pypi package-typo-squatting, I came across a package called pip-audit on an article on the RedHat blog.

I attempted to use it, but I'm quite confused about how to use it when in different python environments.

The tutorial states that you should create an environment for it, so that makes me think that maybe it just reads requirements.txt and searches for known CVEs somewhere.

But that kind of doesn't make sense as I suppose some of these package requirements could be recursive...unless it's recursively looking for requirements.txt or if all of the dependencies are created in the resulting requirements.txt from running pip freeze.

So, should I change to the pip-audit environment and then switch to the directory to run the package audit?

1 Answer 1


I think all of your questions are answered by the project readme.

It appears it can both check for vulnerabilities in packages in the current environment (e.g. the packages that would be shown in pip freeze), as well as checking the packages as specified in requirements files:

Support for auditing local environments and requirements-style files

Seamlessly reuses your existing local pip caches

Additionally, it appears that dependencies are checked by default:

--no-deps don't perform any dependency resolution; requires all requirements are pinned to an exact version (default: False)

As for what environment/directory to run it in, it depends what you are trying to do. To inspect packages within a particular environment, it would make sense to install pip-audit into that environment and run it (regardless of your current directory). If you are just auditing random requirements files, you could install pip-audit into the system packages, user packages, or a standalone environment just for it, and point the tool at the location of the project you'd like to audit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .