Add project: extuno - #294
Open
projectboot wants to merge 1 commit into
Open
projectboot wants to merge 1 commit into
projectboot wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
extunoundersecurity(Code Security).What it is. A CLI that assesses a PyPI release before pip installs it. It resolves the exact version and digest from index metadata, checks it against a known-malicious catalog and against prior analysis, and submits an unseen release for static and sandbox analysis. pip is invoked only when the verdict allows it. The artifact is never downloaded, unpacked, imported or executed on the machine running the CLI, which is the point: a source distribution runs its
setup.pyduring install, and a wheel runs at first import.Where it sits next to the existing entries.
banditreads your own code,safetyandpip-auditmatch installed versions against vulnerability records. This one asks what a package you are about to add actually does, and refuses the install when the answer is bad. Different half of the problem.Pure Python, no runtime dependencies, MIT, CI across 3.9 to 3.13 on Linux, macOS and Windows. Also ships a GitHub action and pre-commit hooks.
Disclosure. I am the author. The CLI is open source; catalog lookups and previously analysed releases resolve free, and first-time analysis of an unseen release is metered against a commercial backend. Noting it plainly since the list carries
safety, which has the same shape.The project is new, so I expect it to sit in the hidden block until it clears
min_stars. Adding it now so it surfaces on its own when it does.