pip-audit

How to run pip-audit

pip install pip-audit

pip-audit                          # the current environment
pip-audit -r requirements.txt      # a requirements file
pip-audit .                        # a local project
pip-audit --fix --dry-run          # show what would be upgraded
pip-audit --fix                    # upgrade vulnerable packages
pip-audit -s osv                   # use OSV instead of PyPI
pip-audit -f cyclonedx-json        # write a CycloneDX SBOM

By default it looks packages up through PyPI's JSON API, which draws on the Python Packaging Advisory Database, and it can use OSV instead. See the project page for the full list of options.

Be careful what you audit

This surprises many people. Auditing a requirements file resolves its dependencies, and the project warns that pip-audit -r INPUT is functionally equivalent to pip install -r INPUT. Package installation can run code, so a malicious package could run during the audit. The project's own rule is simple: if you would not pip install it, do not pip audit it.

This also means the check cannot protect you from a package with no advisory yet, such as a new typosquat or slopsquatting package.

Running pip-audit in CI

There is an official GitHub Action, pypa/gh-action-pip-audit, or you can run the command yourself. It exits with a non-zero code when it finds a vulnerability, so a new advisory can fail a build with no code change.

- run: pip install -r requirements.txt pip-audit
- run: pip-audit

Audit the same dependency set that you ship. Requirements with exact versions and hashes give you a stable result. For where this fits with other checks, see where to run SCA scans.

What pip-audit does not cover

• Your code. It analyzes dependency trees, not source code. For that, see SAST vs SCA.
• Native libraries. Python wheels often bundle C libraries, and the project states it does not detect transitive vulnerabilities in non-Python shared libraries.
• Everything else in the build. Your base image, system packages and CI actions are outside its view.
• New malicious packages. It matches known advisories.
• The build that shipped. Python resolution varies with the environment, so an audit on another machine may see different versions from the release. Without a lockfile, the order of resolution can vary as well.

pip-audit vs other Python scanners

Tool	Good for	Note
pip-audit	Python dependencies, for free	Python only
Trivy, Grype	Python packages inside a container image	Also cover operating system packages
Commercial SCA tools	Policy and workflow across many languages and teams	See the best SCA tools

pip-audit and CRACI

pip-audit is a sensible check on pull requests. CRACI works from the other side: as your GitHub Actions runner, it records every package a job fetched from PyPI and every other source, at every depth of the tree, into an SBOM of the build that produced the release. It then keeps checking that SBOM as new vulnerabilities are published, so you know whether last year's release is affected. See build-time SBOMs and build-time SBOM generation.

pip-audit: frequently asked questions

What is pip-audit?

A tool from the Python Packaging Authority that scans Python environments, requirements files and projects for packages with known vulnerabilities.

Is there an npm audit for Python?

pip-audit is the closest equivalent, but it is a separate tool rather than a pip command, so you install it yourself.

How do you fix vulnerabilities found by pip-audit?

Run pip-audit --fix to upgrade vulnerable packages, or --fix --dry-run first to see what would change. Then run your tests and update your pinned requirements.

Is it safe to run pip-audit on untrusted code?

No. Auditing a requirements file is functionally equivalent to installing it, and installation can run code. If you would not install a package, do not audit it.

Can pip-audit generate an SBOM?

Yes. It can write CycloneDX in JSON or XML. The SBOM describes the Python dependencies it resolved, not the rest of your build.

Which vulnerability database does pip-audit use?

By default PyPI's JSON API, which draws on the Python Packaging Advisory Database. It can also use OSV.