
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
requirements-detector
Advanced tools
requirements-detector is a simple Python tool which attempts to find and list the requirements of a Python project.
When run from the root of a Python project, it will try to ascertain which libraries and the versions of those libraries that the project depends on.
It uses the following methods in order, in the root of the project:
setup.py (if this is successful, the remaining steps are skipped)pyproject.toml (if a tool.poetry.dependencies section is found, the remaining steps are skipped)requirements.txt or requirements.pip*.txt and *.pip files inside a folder called requirements*requirements*.txt or reqs.txt (so for example, pip_requirements.txt would match, as would requirements_common.txt)detect-requirements [path]
If path is not specified, the current working directory will be used.
The output will be plaintext, and match that of a pip requirements file, for example:
Django==1.5.2
South>=0.8
anyjson
celery>=2.2,<3
>>> import os
>>> from requirements_detector import find_requirements
>>> find_requirements(os.getcwd())
[DetectedRequirement:Django==1.5.2, DetectedRequirement:South>=0.8, ...]
If you know the relevant file or directory, you can use from_requirements_txt, from_setup_py or from_requirements_dir directly.
>>> from requirements_detector import from_requirements_txt
>>> from_requirements_txt("/path/to/requirements.txt")
[DetectedRequirement:Django==1.5.2, DetectedRequirement:South>=0.8, ...]
FAQs
Python tool to find and list requirements of a Python project
We found that requirements-detector demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.