search

DataDog / guarddog

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages
https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/
Apache License 2.0
585 stars 43 forks source link

Standardize local scanning behavior #426

Closed ikretz closed 1 month ago

ikretz commented 1 month ago

This PR changes GuardDog's behavior in the case of a local directory scan so that it expects the directory to contain a package. This makes it so that a local scan always expects a (possibly zipped) package directory as its target.

$ guarddog pypi scan ~/Downloads/requests-2.32.3.tar.gz
Found 0 potentially malicious indicators scanning ~/Downloads/requests-2.32.3.tar.gz

$ tar -xf ~/Downloads/requests-2.32.3.tar.gz -C ~/Downloads
$ guarddog pypi scan ~/Downloads/requests-2.32.3
Found 0 potentially malicious indicators scanning ~/Downloads/requests-2.32.3

$

Closes #425