package-doctor

About

package-doctor is an MIT-licensed open source scanner that checks Python project dependencies against CISA's Known Exploited Vulnerabilities list and FIRST's EPSS exploit-probability scores, so developers can prioritize fixing packages that are actively being exploited rather than just those with the most CVEs. It also flags packages that have had no release or commit in over two years, and ships a Claude Code hook that stops an AI coding agent from installing packages that match these risk criteria. It can run standalone, in CI pipelines, or as that agent hook.