safety-db
A curated database of insecure Python packages (by pyupio)
advisory-database
Advisory database for Python packages published on pypi.org (by pypa)
| safety-db | advisory-database | |
|---|---|---|
| 2 | 5 | |
| 755 | 239 | |
| 0.1% | 0.4% | |
| 6.4 | 7.0 | |
| 29 days ago | 4 days ago | |
| Python | ||
| GNU General Public License v3.0 or later | Creative Commons Attribution 4.0 |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
safety-db
Posts with mentions or reviews of safety-db.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-08-18.
-
Known bad PyPi packages
Pyup.io has a community db over here with a big json of package containing vulnerabilities. I am afraid you will have to dig in the data to find a way to filter malicious packages.
-
Auditing your python environment
An open source version that we can freely use. It is updated once a month.
advisory-database
Posts with mentions or reviews of advisory-database.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-07-09.
- LangChain Arbitrary Command Execution - CVE-2023-34541
-
pyscan v0.1.0: A python dependency vulnerability scanner, written in Rust.
source
-
Auditing your python environment
The second tool I want to introduce to you is pip-audit. It is maintained by folks at Trails of Bit with some Google support. It uses the Pypa Advisory Database via the PyPI JSON API as a source of vulnerability reports.
- Adding Auditing to Pip
-
Google's unified vulnerability schema for open source supports Rust on launch
Today, we’re excited to announce a new milestone in expanding OSV to several key open-source ecosystems: Go, Rust, Python, and DWF.
What are some alternatives?
When comparing safety-db and advisory-database you can also consider the following projects:
pip-audit - Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
pyscan - python dependency vulnerability scanner, written in Rust.
Flask - The Python micro framework for building web applications.
vulndb - [mirror] The Go Vulnerability Database
publications - Publications from Trail of Bits
advisory-db - Security advisory database for Rust crates published through crates.io
dwflist - The DWF IDs
langchain - 🦜🔗 Build context-aware reasoning applications
Nuget Package Manager - Repo for NuGet Client issues
pre-commit - A framework for managing and maintaining multi-language pre-commit hooks.
safety-db vs pip-audit
advisory-database vs pyscan
safety-db vs Flask
advisory-database vs vulndb
safety-db vs publications
advisory-database vs advisory-db
advisory-database vs dwflist
advisory-database vs publications
advisory-database vs langchain
advisory-database vs Nuget Package Manager
advisory-database vs pre-commit
advisory-database vs pip-audit