search

DataDog / guarddog

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages
https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/
Apache License 2.0
585 stars 43 forks source link

Unexpected behavior for local directory scan #425

Closed ikretz closed 1 month ago

ikretz commented 1 month ago

GuardDog behaves unexpectedly when run against a local directory. It does not consider that the directory will contain a package to scan. Instead, it behaves as though the directory will contain a mix of package tarballs and directories containing packages, listing the directory contents and scanning each one individually.

$ guarddog pypi scan ~/Downloads/requests-2.32.3.tar.gz
Found 0 potentially malicious indicators scanning ~/Downloads/requests-2.32.3.tar.gz

$ tar -xf ~/Downloads/requests-2.32.3.tar.gz -C ~/Downloads/
$ guarddog pypi scan ~/Downloads/requests-2.32.3
Traceback (most recent call last):
...
ValueError: unsupported archive extension: ~/Downloads/requests-2.32.3/PKG-INFO
$

We should make it so the local directory scan behavior conforms to expectations. This has the advantage of clarifying what a local scan target must be: a (possibly zipped) directory containing a package.