1,381 stars · Apache-2.0 (the README notes reused examples from resolvelib, which is ISC) · 2.10.1 (2026-06-10), confirmed on PyPI, which is the authority for a Python tool · Track this in Scout
Checks a Python project's packages against the public advisory database and names the ones with known security holes.
▶Repo detailsthe review · specs · pros & cons · install
What it does
pip-audit reads the packages installed in an environment, or the list in a requirements.txt file, or the dependency tree of a project folder, and compares each one against the Python Packaging Advisory Database through the PyPI interface. You can point it at the OSV database instead. It prints a table by default, and can produce JSON or Markdown, or a parts list in CycloneDX format. With --fix it upgrades the unsafe packages rather than only reporting them. It exits with code 0 when nothing is found and 1 when something is, which is what makes it usable in an automated check; there is an official GitHub Action and a pre-commit hook. It is kept by the Python Packaging Authority, the group behind pip itself, and code was committed on 15 October 2026. The project is unusually clear about its edges, and they matter. It does not read your code, only the list of dependencies. It is no defence against a deliberately malicious package, and the README says plainly that auditing a requirements file is no safer than installing it. It will not notice a hole in a non-Python library that a Python package wraps. And it does not read Pipfile or Pipfile.lock without conversion.
Why it matters
Who it suits. Anyone with a Python project whose dependency list was assembled by somebody or something else. That describes almost every project built with help from a model, because the packages were chosen in seconds and nobody read the list afterwards. It also suits anyone who has inherited a project nobody has touched in a year. Skip it if your work is not in Python; the same job for other languages is done by aquasecurity/trivy, below.
Verdict. Run it today. This is the shortest distance between effort and useful information anywhere in this edition: one install, one command, and a list of real problems with real fixes. Two minutes. The honesty of its documentation is the other reason to trust it. A tool that lists four things it cannot do, including the uncomfortable one about malicious packages, is a tool whose positive claims are worth something. The obvious comparison is pyupio/safety, which does the same job and asks you to log in, with commercial use starting at $25 per seat per month. pip-audit asks for nothing. Pair it with entry 7 if you also need a record of what was in a build, rather than only what is wrong with it.
- One command, no account, no sign-up and no paid tier. It is maintained by the same group that maintains pip.
--fixupgrades the unsafe packages instead of leaving you to work out the safe version yourself.- Documentation that states, in detail, what the tool cannot do.
- Python only. A project with JavaScript or Go in it needs a second tool.
- It reads dependency lists, not code, so a hole written directly into a project goes unseen.
- It cannot ignore a known-but-unfixed problem on its own. You have to process the JSON output elsewhere to do that.
- pyupio/safety
At about 2,000 stars, the same check for Python packages, but scans prompt for an account and commercial use starts at $25 per seat per month.
Track this in Scout 
aquasecurity/trivyAt 38,100 stars and Apache-2.0, a much larger scanner that covers containers, Kubernetes, code repositories and clouds, and finds misconfiguration and leaked secrets as well as vulnerable packages.
Track this in Scout
python3 -m venv venv source venv/bin/activate python3 -m pip install pip-audit
