The gate goes in front of
pip install

Does pip install actually run code?

It depends on what pip fetched, and the honest answer has two halves. This is the detail most write-ups skip, and it is why a check that only looks at one half misses most real incidents.

Most of the well known PyPI compromises fired at import rather than at install. The PyTorch advisory for torchtriton states it plainly: the malicious binary ran when the package was imported. So the useful question is not which of the two moments a payload picks. It is whether anything gets decided before the code is on your disk at all.

Three outcomes, one command

Real output. The verdict decides whether pip is reached at all.

$ extuno pip install six
  - six 1.17.0 ........................ sha256 ff70335d468e7eb6
  - checking Extuno ................... not analysed yet
  - scan queued ....................... 1 credit 0738cabf
  - downloading package ............... in the isolated environment
  - dynamic analysis .................. running in the sandbox
  - analysis complete
  verdict CLEAN  risk 0/100

OK verdicts acceptable, installing
Successfully installed six-1.17.0

$ extuno pip install requests
  - requests 2.34.2 ................... sha256 f288924cae4e2946
  - checking Extuno ................... already analysed, no credit used
  verdict CLEAN  risk 0/100

OK verdicts acceptable, installing

$ extuno pip install <package from the catalog>
  - checking Extuno ................... listed in the malicious database
  verdict MALICIOUS
    malicious-package  Listed in the Datadog malicious-software-packages dataset

BLOCKED 1 of 1 package(s) blocked
$ echo $?
1

Install and first run

1. Install the tool

   It has no third-party requirements, so it drops into any environment or CI image.

   pip install extuno

2. Authenticate once

   Create an API key in the console. The key is stored with owner-only permissions; in CI set EXTUNO_API_KEY and skip this step.

   extuno login --key extk_...

3. Put it in front of pip

   Use it exactly like pip. Your usual arguments are passed through untouched.

   extuno pip install -r requirements.txt

Does uv audit or pip-audit already cover this?

They cover a different question, and the tools say so themselves.

The two are complements, not substitutes. Keep your advisory scanner for the CVEs in what you already run; put this in front of what you are about to add. See the longer comparison in Extuno versus package supply-chain scanners.

What this class of attack has looked like

Every row is a documented PyPI compromise, with the moment the payload actually ran. The pattern worth noticing: the execution point moves, so a check tied to one of them is a check with a blind spot.

Volume is not the story. ReversingLabs reported that malware found on PyPI fell 43 percent over the past year while npm roughly doubled. What rose on PyPI is targeting: AI and ML packages, CI credentials, and forged supply-chain provenance. The OpenSSF malicious-packages dataset currently records over 11,000 PyPI entries, and Extuno checks every request against that catalog plus its own, at no cost and with no scan.

When an agent runs the install, not a person

A coding agent that writes and then runs pip install removes the one review step this ecosystem relied on: someone reading the package name before pressing enter.

Language models invent dependency names. A USENIX Security 2025 study generated 576,000 code samples across 16 models and found 205,474 unique hallucinated package names, at 5.2 percent of recommendations from commercial models and 21.7 percent from open ones. Attackers register the names that recur, so the agent's invented import resolves to a real, hostile package. The paper's own recommendation is a two-step flow where the install the agent proposes is confirmed before it runs.

That is what this tool is, expressed as a command. Point the agent at extuno pip install instead of pip install, and every package it reaches for is assessed before it lands, with the decision recorded rather than assumed.

A verdict is not a risk score

A widely used library that ships an integration test suite, a throwaway certificate, and a permissive TLS option scores high. None of that is evidence of intent, so it does not block an install. A pre-install gate that cries wolf gets removed from the pipeline within a week.

Raise the bar with --fail-on malicious,suspicious,review,unknown when a pipeline should stop on anything unresolved. The rules behind these verdicts are documented in the detection rule set.

Nothing hostile runs on your machine

This is the property the design is built around, not a feature bolted onto it.

• The artifact is never fetched locally. The tool reads the index's JSON metadata to learn the version and digest. Nothing is downloaded, unpacked, imported, or executed on the developer's machine.
• Analysis runs in a disposable microVM. Extuno fetches and detonates the package inside a network-segmented virtual machine that is destroyed after every run, with a decoy home directory so only fake credentials are ever there to steal.
• requirements.txt is parsed as text. pip's resolver is not used for the assessment, because resolving a source distribution can execute its build backend, which is the event this tool exists to get in front of.
• Unassessable arguments stop the install. A direct URL, a local path, an editable, or an index override cannot slip past the gate unchecked; they halt the run unless you pass --allow-unassessed.
• No dependencies of its own. The package installs with zero third-party requirements. A supply-chain tool that pulls in a dependency tree adds the risk it was brought in to remove.

Built for the pipeline

extuno check never installs anything. It assesses, writes machine-readable output, and sets an exit code.

- name: Supply-chain gate
  env:
    EXTUNO_API_KEY: ${{ secrets.EXTUNO_API_KEY }}
  run: |
    pip install extuno
    extuno check -r requirements.txt \
      --sarif extuno.sarif --json report.json

- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: extuno.sarif

Questions people actually ask