betanpm / PyPI Trust Scanner
Package Scanner
Supply-chain trust + typosquat + CVE check for any package.
In the wild— Package Scanner runs— Issues surfaced— Countries· opt-in only
The problem
Every install pulls 100+ transitive deps. Typosquats are a real attack path; CVEs hide in indirect dependencies.
What it does
Submit a package name; we pull registry metadata, compute typosquat distance to popular packages, surface CVEs via OSV, score maintainer trust, and list top dependents for blast-radius.
Capabilities
- Trust score with maintainer signals
- Typosquat distance to popular packages
- CVE surface (direct + transitive) via OSV
- npm + PyPI supported; cargo / RubyGems on the roadmap
How you run it
Type a package name in the browser; trust report renders in seconds. Subscriber API keys for CI checks are on the roadmap.
Roadmap
- npm + PyPI lookup
- CVE join via OSV
- In-browser lookup form
- Subscriber API keys for CI
Included with any PlayCISO plan
Package Scanner runs inside PlayCISO for subscribers. The source stays private — no public repos, nothing to fork, nothing for attackers to study. Weekly, monthly, and yearly plans all include every tool.