A Python SCA tool inventories every package your project depends on — from any of Python's several manifest formats — and checks each against known vulnerabilities, supply-chain risk and license obligations. DepWarden is a free one: paste a manifest and get prioritised findings in seconds, no account.
Unlike npm's one dominant lockfile format, Python has several: requirements.txt (pinned or ranged, the oldest and most common), Pipfile.lock (pipenv), poetry.lock (Poetry, the modern standard), pyproject.toml (PEP 621 declared dependencies), and conda environment files for data-science projects. A real Python SCA tool has to parse all of them — a project pinned via Poetry that only gets checked against a stale, hand-written requirements.txt gives a false sense of coverage. DepWarden parses all five formats.
Known CVEs across the resolved dependency set, matched against the OSV PyPI advisory feed and enriched with CISA KEV and FIRST EPSS. Typosquats — a single-character PyPI typo installs a malicious package with no advisory to match against; edit-distance detection catches this class that CVE-only scanners miss entirely. End-of-life Python and package release lines — Python 3.8 reached EOL in October 2024, and pinning to an EOL interpreter or an EOL Django 2.x line carries ongoing risk with no specific CVE attached. OpenSSF Scorecard health, deprecated-package markers, and license risk via SPDX categorisation with a generated NOTICE file.
Upload a source zip alongside your manifest (or connect a repo branch) and DepWarden also runs Python-specific static analysis in the same pass: SQL injection via f-strings and string concatenation, subprocess/os.system command injection, Django DEBUG = True in production, hardcoded credentials, and weak cryptography.
Usage: paste any supported Python manifest at depwarden.in, or connect a repo branch for a scheduled scan. Related: better pip-audit alternative, software composition analysis, what is SAST?.