Check Python packages before they reach your environment.
A small, fast CLI that does dependency legitimacy checks before install — using public package and vulnerability signals to surface obvious risk early.
Role
Python supply-chain guardrail
Year
2025
Surface
CLI · pre-install hook
Status
Open source
01The problem
By the time pip install finishes, it's already too late.
Most Python supply-chain attacks rely on the install step running before anyone looks at the package: typo-squatted names, suspicious maintainer rotations, version yanks paired with re-uploads.
pipguard-cli inserts the smallest possible pause before that step: check the public signals, surface the obvious risk, let the developer proceed with intention.
Snake in coil, locks in line. The metaphor stays close.
02The approach
One tool, one job. Keep it fast enough to actually run.
pipguard does not try to replace your scanner. It runs before install, in under a second, and gives you a clear yes / no / look-closer for every dependency you're about to pull in.
Public sources only. No telemetry. Open source by construction.
Specifications
“The right place to ask the question is before the question stops mattering.”
— Studio note
Previous work
← VeriLink