Open Source Dependency Security Checker for Python & VS Code

Dependency Security Checker is an open-source tool designed to locally analyze installed Python packages and VS Code extensions to identify elements known as deprecated, archived, renamed, inactive or unmaintained.

Dependency Security Checker is a local and open-source tool designed to quickly check Python packages and VS Code extensions installed in a development environment.

It compares detected elements against local alert databases to identify those known as deprecated, archived, renamed, inactive or unmaintained.

The goal is not to automatically decide whether a dependency should be removed or replaced, but to provide initial information that helps developers identify elements that may require further verification.

Python Packages

The checker.py script analyzes packages installed in the active Python environment and compares them against the local alerts.json database.

When a match is found, the report can display the affected package, its installed version, its status, the reason for the alert, a suggested replacement when available, as well as the source used to verify the information.

VS Code Extensions

The extension.py script retrieves the extensions installed in VS Code along with their versions, then compares them against the local extensions.json database.

When a known extension is detected, the report displays its status, the reason for the alert, a possible alternative and the corresponding source.

An Alert Is Not a Vulnerability

The presence of an alert does not necessarily mean that a package or extension has a security vulnerability. It indicates that an element matches a known entry in the project's database and may require further verification.

This verification can form part of a broader application security approach.

Local and Read-Only Analysis

Comparisons are performed locally against the JSON files included in the project, without sending the list of packages or extensions to a remote server, an approach consistent with data security principles.

The tool operates in read-only mode: it does not uninstall, disable, update or automatically replace any element.

The project requires Python 3 and no external Python dependency is required for it to run.

• Analyze Python packages: python checker.py
• Analyze VS Code extensions: python extension.py

To analyze a specific Python virtual environment, activate it before running checker.py. For extension analysis, Visual Studio Code must be installed and the code command must be available from the terminal.

The alert databases are not intended to be exhaustive. The absence of an alert does not guarantee that a package or extension is maintained, secure or free from vulnerabilities.

The sources associated with the alerts make it possible to perform additional verification before making any decision regarding a dependency.

The project is open source under the MIT license. Contributions can help expand the alert databases, correct existing information, add sources or improve the checkers.

➜ View project on GitHub

Download project