Scan dependencies across multiple ecosystems with typosquat detection.

• Multi-ecosystem: Cargo, npm, PyPI, Go
• Typosquat detection: Levenshtein-based similarity check against known packages
• Multiple lockfile formats: Cargo.lock, package-lock.json, requirements.txt, go.mod, poetry.lock, Pipfile.lock
• JSON output: For automation and CI integration
• Rich terminal output: Tables, panels, progress bars

pip install depscan

Or from source:

git clone https://github.com/yunaremaia/depscan.git
cd depscan
pip install -e .

# Scan current directory
depscan scan .

# Scan a specific path
depscan scan /path/to/project

# Output as JSON
depscan scan . --json-output > deps.json

# List all dependencies
depscan list-deps .

# Check a specific package
depscan check requests 2.28.0

# Show supported ecosystems
depscan info

Scan a directory for dependencies and detect potential issues.

depscan scan . --typosquat  # Enable typosquat detection (default)
depscan scan . --no-typosquat  # Disable typosquat detection
depscan scan /path/to/project --json-output  # JSON output

List all dependencies found in a directory.

depscan list-deps .
depscan list-deps /path/to/project --json-output

Check a specific dependency name for typosquat potential.

depscan check raquests 1.0.0  # ⚠ Potential typosquat of "requests"
depscan check requests 2.28.0  # ✓ No issues

Show supported ecosystems and formats.

depscan uses Levenshtein edit distance to detect potential typosquats:

• Distance ≤ 2: Flagged as potential typosquat
• Known packages: Whitelisted to avoid false positives
• Ecosystem-aware: Checks against common package names

Example:

⚠ Potential typosquat detected!
   raquests is similar to requests

Both JSON outputs include a $schema key pointing at the published schema, so consumers can validate before parsing.

Validated by schemas/depscan-output.json.

{
  "$schema": "https://raw.githubusercontent.com/yunaremaia/depscan/main/schemas/depscan-output.json",
  "total": 42,
  "typosquats": [
    {
      "name": "raquests",
      "version": "1.0.0",
      "target": "requests"
    }
  ],
  "by_ecosystem": {
    "pypi": 25,
    "npm": 17
  }
}

Fields:

• total (integer) — total dependencies found across all lockfiles and manifests
• typosquats (array) — dependencies whose names are near-misses of popular packages
  • name — the dependency name as written in the manifest
  • version — pinned version of the dependency
  • target — the well-known package name it appears to imitate
• by_ecosystem (object) — dependency count per ecosystem (cargo, npm, pypi)

Validated by schemas/depscan-list-deps.json.

[
  {
    "name": "requests",
    "version": "2.31.0",
    "ecosystem": "pypi"
  }
]

Fields:

• name — dependency name
• version — pinned version from the lockfile or manifest
• ecosystem — one of cargo, npm, pypi

depscan scan . --json-output | python3 -c "
import json, sys, jsonschema
jsonschema.validate(json.load(sys.stdin), json.load(open('schemas/depscan-output.json')))
"

# Setup
git clone https://github.com/yunaremaia/depscan.git
cd depscan
pip install -e ".[dev]"

# Run tests
pytest

# Run tests with coverage
pytest --cov=depscan

Contributions welcome! See CONTRIBUTING.md for guidelines.

MIT