Pipask – safer pip without compromising convenience

In plain words

Pipask is a drop-in replacement for pip that addresses security risks by preventing arbitrary code execution during dependency resolution. Instead of installing packages immediately, it retrieves metadata through PyPI's JSON API and analyzes repository popularity, download counts, package age, and known vulnerabilities. The tool generates a detailed report and requests user consent before installation, giving developers control over what code runs on their system.

written from the facts on this page · September 2026

From the sources

Safer python package installs with audit and consent 𝘣𝘦𝘧𝘰𝘳𝘦 install - feynmanix/pipask

A safer way to install Python packages without compromising convenience. Pipask is a drop-in replacement for pip that performs security checks before installing a package. Unlike pip , which needs to download and execute code from source distribution first to get dependency metadata, pipask relies on metadata from PyPI whenever possible. If 3rd party code execution is necessary, pipask asks for consent first. The actual installation is handed over to pip if installation is approved. pipask install requests pipask install ' fastapi>=0.100.0 ' pipask install -r requirements.txt For maximum convenience, alias pip to point to pipask: alias pip= ' pipask ' Add this to your shell configuration…from github.com

In the maker’s words, at launch

Pipask is a drop-in replacement for pip that addresses a serious security flaw: standard pip executes arbitrary code from source distributions during dependency resolution, without warning or consent. Pipask retrieves metadata through PyPI's JSON API first, then checks repository popularity, download counts, package…

• 
  Pip Imports in Deno2023 · github.com · ▲192

  deno_python 0.3.1 adds support for importing python pip packages directly in JavaScript! Fun and useful, slightly cursed.

• 
  Pyp – Easily, magically, run Python at the shell2020 · github.com · ▲285

  Easily run Python at the shell! Magical, but never mysterious. - hauntsaninja/pyp

• 
  A curated list of insecure Python packages2016 · github.com · ▲94

  A curated database of insecure Python packages. Contribute to pyupio/safety-db development by creating an account on GitHub.

• 
  PIP2022 · getpip.com · ▲102

  Web 3 layer for the creator economy

• II
  Is it vulnerable? Drag-n-drop your Gemfile.lock to check2015 · isitvulnerable.com · ▲175
• 
  deptry 0.14.0 – detect unused Python dependencies up to 10 times faster2024 · github.com · ▲142

  deptry 0.14.0 was just released, bringing significant speed improvements: It is now up to 10 times faster than the previous release! For those unfamiliar with deptry; deptry is a command line tool to check for issues with dependencies in a Python project, such as unused or missing dependencies. GitHub: https://github.com/fpgmaas/deptry For some benchmarks of the new release, see the release notes: https://github.com/fpgmaas/deptry/releases/tag/0.14.0 The performance improvement was achieved by leveraging Rust to parse the AST and extract…

• 
  Run full iOS 16.5 firmware on Android Devices▲506

  Contribute to oosexgang/hackios-xnu-kernel development by creating an account on GitHub.

  Dev tools · 1d ago · github.com

• 
  /dev/null▲493

  a social network for devs

  Dev tools · 4d ago · dev-null.sh

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 29d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 27d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 24d ago · openbot.run

• 
  Talanoa▲346

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 22d ago · talanoa.email

• 
  Tapflow 2.0▲1,125

  We built Tapflow for devs, designers, PMs, and tech folks who’ve been sitting on internal docs, templates, and systems — but never productized them. Upload a PDF, notes, or workshop deck, and Tapflow drafts a structured product (with chapters, teaser and pricing plans). It’s good for AI kits, onboarding guides, design systems, and frameworks. You can sell through Stripe, LemonSqueezy, or PayPal. Real-time collaboration is in early beta. No site builder, no LMS — clean design and just focused tools to ship. Fully bootstrapped and just launched on PH today →…

  Work · 2025 · tapflow.ai

• C9
  Clippy – 90s UI for local LLMs▲1,122

  Life & fun · 2025 · felixrieseberg.github.io

• 
  Appwrite Sites▲990

  Appwrite 2.0 brings a new engine, a rebuilt Console, five database types, an S3 API, an OAuth 2.1 server, and organization-level Domains and Firewall.

  Dev tools · 2025 · appwrite.io

• 
  AI Meeting Notes by Notion▲965

  Perfect meeting memory in Notion

  AI · 2025 · notion.com

• 
  Den▲948

  Multiplayer AI agent builder

  AI · 2025 · getden.io

• 
  Raycast for iOS▲870

  Powerful productivity on the go

  AI · 2025 · raycast.com