Dev tools · alternatives · 2026

24 alternatives to A curated list of insecure Python packages

A curated database of insecure Python packages. Contribute to pyupio/safety-db development by creating an account on GitHub.

A curated list that identifies insecure Python packages, helping developers avoid vulnerable dependencies in their projects. It's designed for Python developers who need to check whether packages they use have known… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. A curated list of insecure Python packages launched in 2016; newer entries below may have overtaken it.

1. 1
   Py-spy – A new sampling profiler for Python programs▲286

   Sampling profiler for Python programs. Contribute to benfred/py-spy development by creating an account on GitHub.

   2018 · github.com · its alternatives →

2. 2
   Opengrep▲340

   The open source code security engine

   2025 · opengrep.dev · its alternatives →

3. 3II
   Is it vulnerable? Drag-n-drop your Gemfile.lock to check▲175

   2015 · isitvulnerable.com · its alternatives →

4. 4
   deptry 0.14.0 – detect unused Python dependencies up to 10 times faster▲142

   deptry 0.14.0 was just released, bringing significant speed improvements: It is now up to 10 times faster than the previous release! For those unfamiliar with deptry; deptry is a command line tool to check for issues with dependencies in a Python project, such as unused or missing dependencies. GitHub: https://github.com/fpgmaas/deptry For some benchmarks of the new release, see the release notes: https://github.com/fpgmaas/deptry/releases/tag/0.14.0 The performance improvement was achieved by leveraging Rust to parse the AST and extract…

   2024 · github.com · its alternatives →

5. 5
   Hatch – A modern project, package, and virtual env manager for Python▲108

   Modern, extensible Python project management. Contribute to pypa/hatch development by creating an account on GitHub.

   2017 · github.com · its alternatives →

6. 6
   4smart Packages Overview▲75

   Monitor NuGet and NPM packages in your repositories

   2021 · its alternatives →

7. 7
   Pydb – a lightweight database with Python syntax queries, using ZeroMQ▲130

   A lightweight database with Python syntax queries, using ZeroMQ - asrp/pyzdb

   2017 · github.com · its alternatives →

8. 8
   Python requirements for Humans▲78

   Python requirements made easy. Contribute to toxinu/requirements development by creating an account on GitHub.

   2016 · github.com · its alternatives →

9. 9
   A news aggregator for the Python community written in Python/Django▲106

   A Hacker News lookalike written in Python/Django, powering https://news.python.sc - sebst/pythonic-news

   2019 · github.com · its alternatives →

10. 10
    zodiac, a new approach to monkey patching in python▲39

    A monkeypatching library for python. Contribute to colinmarc/zodiac development by creating an account on GitHub.

    2012 · github.com · its alternatives →

11. 11
    Pipask – safer pip without compromising convenience▲52

    Pipask is a drop-in replacement for pip that addresses a serious security flaw: standard pip executes arbitrary code from source distributions during dependency resolution, without warning or consent. Pipask retrieves metadata through PyPI's JSON API first, then checks repository popularity, download counts, package age, and known vulnerabilities before allowing installation. It presents you with a pretty report and asks for you consent with installation, giving you control over what code runs on your system. More details in the intro blog post:…

    2025 · github.com · its alternatives →

12. 12
    PyDeps▲9

    The Most Complete Python Package Dependency Explorer

    Jul 2026 · pydeps.com · its alternatives →

13. 13
    A simple, highly commented, rootkit which attacks GCC and Python▲94

    2014 · github.com · its alternatives →

14. 14
    PySchemes – A library for validating data structures in Python▲94

    PySchemes is a library for validating data structures in python - spy16/pyschemes

    2017 · github.com · its alternatives →

15. 15
    A quality checker for Python wheels▲42

    Check your wheels have the right contents. Contribute to jwodder/check-wheel-contents development by creating an account on GitHub.

    2020 · github.com · its alternatives →

16. 16
    A design-by-contract Python package in ~100 lines▲58

    Greetings! A 2.5 weekends project to teach myself newer Python features (>= 3.10). Conditions are written as Lambda expressions that annotate parameters and return types, and coexist with type annotations. Symbols to share values between conditions are also supported to a limited extend.

    2022 · github.com · its alternatives →

17. 17
    A Curated List for Application Security▲21

    A curated list of resources for learning about application security - awesome-appsec/README.md at master · paragonie/awesome-appsec

    2015 · github.com · its alternatives →

18. 18
    SafeDep Vet▲72

    GitLab CI Component that lets you seamlessly protect your pipelines from vulnerable and malicious open source dependencies. The component integrates directly into your CI/CD workflow through the GitLab CI Catalog and allows you to establish policy-driven guardrails using Common Expression Language (CEL). Key features: - Set your own opinionated security policies as code using CEL - Detect and block risky OSS components before they enter your codebase - Seamless integration as a native GitLab CI Component - Available directly in the GitLab CI Catalog Try and lets us know our thoughts!

    2023 · safedep.io · its alternatives →

19. 19TD
    Trusty – Dependency Software Supply Chain Security▲14

    Trusty - Search for an open source package to understand its trustworthiness based on activity, provenance, and more. Brought to you by the founders of projects such as Kubernetes and Sigstore. Hey, Luke here the CTO of stacklok. This is an early experimental preview of Trusty. We use statistical analysis to observe millions of packages and found that Malware typically follows certain patterns. We found this tool really useful to help understand the packages we our pulling into our software and wanted to share it with others. It's still early in and we have a lot more features that will be…

    2023 · trustypkg.dev · its alternatives →

20. 20
    Packagr.app – a private package repository with security scanning▲43

    Host private Python, Docker, NPM, Debian, and Conda packages. Private package registry with 4.5x faster installs, CVE scanning, and SSO. Up to 80% cheaper than Cloudsmith. Free tier available.

    2019 · packagr.app · its alternatives →

21. 21
    A curated list of great puzzles▲59

    A curated list of great puzzles. Contribute to sharkdp/great-puzzles development by creating an account on GitHub.

    2015 · github.com · its alternatives →

22. 22PI
    PkgHub.io - Simple Ubuntu Package Hosting▲48

    License and distribute your packages with our private npm registry.

    2013 · pkghub.io · its alternatives →

23. 23
    Dependabot – Automated Dependency Update PRs for Ruby, JS, Python and PHP▲51

    GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.

    2017 · dependabot.com · its alternatives →

24. 24
    I built a tool for policy driven vetting of open source packages▲7

    Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)

    2023 · github.com · its alternatives →

Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →