Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
|Build Status| |codecov| |PyPI|
.. |Build Status| image:: https://github.com/r1chardj0n3s/pip-check-reqs/workflows/CI/badge.svg :target: https://github.com/r1chardj0n3s/pip-check-reqs/actions .. |codecov| image:: https://codecov.io/gh/r1chardj0n3s/pip-check-reqs/branch/master/graph/badge.svg :target: https://codecov.io/gh/r1chardj0n3s/pip-check-reqs .. |PyPI| image:: https://badge.fury.io/py/pip-check-reqs.svg :target: https://badge.fury.io/py/pip-check-reqs
It happens: you start using a module in your project and it works and you
don't realise that it's only being included in your virtualenv
_ because
it's a dependency of a package you're using. pip-missing-reqs finds those
modules so you can include them in the requirements.txt
_ for the project.
Alternatively, you have a long-running project that has some packages in requirements.txt that are no longer actively used in the codebase. The pip-extra-reqs tool will find those modules so you can remove them.
.. _virtualenv
: https://virtualenv.pypa.io/en/latest/
.. _requirements.txt
: https://pip.pypa.io/en/latest/user_guide.html#requirements-files
Assuming your project follows a layout like the suggested sample project::
setup.py
setup.cfg
requirements.txt
sample/__init__.py
sample/sample.py
sample/tests/test_sample.py
Basic usage, running in your project directory::
<activate virtualenv for your project>
pip-missing-reqs --ignore-file=sample/tests/* sample
This will find all imports in the code in "sample" and check that the packages those modules belong to are in the requirements.txt file.
Additionally it is possible to check that there are no dependencies in requirements.txt that are then unused in the project::
<activate virtualenv for your project>
pip-extra-reqs --ignore-file=sample/tests/* sample
This would find anything that is listed in requirements.txt but that is not imported by sample.
To make your life easier, copy something like this into your tox.ini::
[testenv:pip-check-reqs]
deps=-rrequirements.txt
commands=
pip-missing-reqs --ignore-file=sample/tests/* sample
pip-extra-reqs --ignore-file=sample/tests/* sample
Your test files will sometimes be present in the same directory as your application source ("sample" in the above examples). The requirements for those tests generally should not be in the requirements.txt file, and you don't want this tool to generate false hits for those.
You may exclude those test files from your check using the --ignore-file
option (shorthand is -f
). Multiple instances of the option are allowed.
If your project has modules which are conditionally imported, or requirements
which are conditionally included, you may exclude certain modules from the
check by name (or glob pattern) using --ignore-module
(shorthand is -m
)::
# ignore the module spam
pip-missing-reqs --ignore-module=spam sample
# ignore the whole package spam as well
pip-missing-reqs --ignore-module=spam --ignore-module=spam.* sample
If your project uses pyproject.toml
instead of requirements.txt
, you can
use an external tool like pdm
to convert it to requirements.txt
::
# requires `pip install pdm`
pdm export --pyproject > requirements.txt
Then you can use pip-missing-reqs
and pip-extra-reqs
as usual.
Josh Hesketh -- who refactored code and contributed the pip-extra-reqs tool.
Wil Cooley -- who handled the removal of normalize_name and fixed some bugs.
2.5.2
2.5.1
__main__
.2.5.0
pip
requirement to 23.2.2.4.4
packaging
requirement to >= 20.5. Older versions of pip-check-reqs
may be broken with the previously-specified version requirements.2.4.3
2.4.2
python_requires
to metadata; from now on, releases of
pip-check-reqs
are marked as compatible with Python 3.8.0 and up.--version
flag show interpretter version and path to the package which
pip-check-reqs is running from, similar to information shown by pip --version
.-V
is now an alias of --version
.2.3.2
2.3.1
--skip-incompatible
skipping other requirements too.2.3.0
2.2.2
<unknown>
.2.2.1
2.2.0
--skip-incompatible
flag to pip-extra-reqs
, which makes it ignore
requirements with environment markers that are incompatible with the current
environment.--requirements-file
flag to pip-extra-reqs
and pip-missing-reqs
commands. This flag makes it possible to specify a path to the requirements
file. Previously, "requirements.txt"
was always used.-d
and -v
flags.2.1.1
2.1.0
2.0.1
2.0 renamed package to pip_check_reqs
1.2.1
1.2.0
1.1.9
1.1.8
1.1.7
1.1.6
1.1.5
1.1.4
1.1.3
1.1.2
1.1.1
1.1.0
FAQs
Find packages that should or should not be in requirements for a project
We found that pip-check-reqs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.