
Research
Security News
Malicious npm Packages Use Telegram to Exfiltrate BullX Credentials
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
A utility to analyze a Python project and its virtual environment to identify unused direct dependencies. Helps you keep your dependency list lean and accurate.
A utility to analyze a Python project and its virtual environment to identify direct dependencies. Helps you keep your dependency list lean and accurate.
pip install direct-deps
source venv/bin/activate
pip install direct-deps
# No need to specify venv since direct-deps can detect the virtualenv if installed in it.
direct-deps .
pipx install direct-deps
# You must pass in the location of your virtualenv
# hatch: hatch env find
# pipenv: pipenv --venv
direct-deps . --venv venv
To split packages and dev-packages you can do the following.
# Sample Project Structure
├── pyproject.toml
├── src
│ └── comma-cli
│ └── ...
└── tests
└── ...
[flavio@Mac ~/dev/github.com/FlavioAmurrioCS/comma-cli]
$ hatch shell
source "/Users/flavio/Library/Application Support/hatch/env/virtual/comma-cli/NLCv5VCj/comma-cli/bin/activate"
(comma-cli)
[flavio@Mac ~/dev/github.com/FlavioAmurrioCS/comma-cli]
$ pip install direct-deps
...
(comma-cli)
[flavio@Mac ~/dev/github.com/FlavioAmurrioCS/comma-cli]
$ direct-deps src
Direct Dependencies:
- persistent-cache-decorator
- requests
- rich
- setuptools-scm
- typedfzf
- typer
(comma-cli)
[flavio@Mac ~/dev/github.com/FlavioAmurrioCS/comma-cli]
$ direct-deps tests
Direct Dependencies:
- pytest
- runtool
- tomlkit
- typer
# So my [packages] would be
persistent-cache-decorator
requests
rich
setuptools-scm
typedfzf
typer
# And my [dev-packages] would be, notice that since typer is a main dependency, there is no need to list it in this section.
pytest
runtool
tomlkit
This tool relies on being able to look at the import <package>
and from <package> import ...
as
well as use your virtualenv to find the appropiate package name. This means that that anything
not imported directly will not appear the the list such as plugins (pytest-cov) and static analysis tools(ruff, pre-commit).
direct-deps
is distributed under the terms of the MIT license.
FAQs
A utility to analyze a Python project and its virtual environment to identify unused direct dependencies. Helps you keep your dependency list lean and accurate.
We found that direct-deps demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Research
Security News
Malicious npm packages posing as developer tools target macOS Cursor IDE users, stealing credentials and modifying files to gain persistent backdoor access.
Security News
AI-generated slop reports are making bug bounty triage harder, wasting maintainer time, and straining trust in vulnerability disclosure programs.