DataDog / guarddog

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages
https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/
Apache License 2.0
585 stars 43 forks source link

Consolidate local target checks #416

Closed ikretz closed 1 month ago

ikretz commented 2 months ago

This PR makes three principal changes:

  1. It defines functions in guarddog/utils/archives.py for checking whether a file extension is for a supported archive format and uses them pervasively

  2. It clarifies the conditions under which Guarddog will decide to perform a local scan on a target: whenever the target is a directory or a regular file in the local filesystem. It also eliminates as much as possible duplicate checking for whether the target is local and what kind of local target it is (file or directory)

  3. It makes sure that PackageScanner.scan_local() uses its callback argument, closing issue #411