Python Packages
The checker.py script analyzes packages installed
in the active Python environment and compares them against the local
alerts.json database.
When a match is found, the report can display the affected package, its installed version, its status, the reason for the alert, a suggested replacement when available, as well as the source used to verify the information.
VS Code Extensions
The extension.py script retrieves the extensions
installed in VS Code along with their versions, then compares them
against the local extensions.json database.
When a known extension is detected, the report displays its status, the reason for the alert, a possible alternative and the corresponding source.
An Alert Is Not a Vulnerability
The presence of an alert does not necessarily mean that a package or extension has a security vulnerability. It indicates that an element matches a known entry in the project's database and may require further verification.
This verification can form part of a broader application security approach.
Local and Read-Only Analysis
Comparisons are performed locally against the JSON files included in the project, without sending the list of packages or extensions to a remote server, an approach consistent with data security principles.
The tool operates in read-only mode: it does not uninstall, disable, update or automatically replace any element.