v1.1.0 — PyPI ecosystem support

1.1.0 — 2026-08-05 — PyPI ecosystem support

In plain terms: pkgxray now scans Python packages, not just npm. Point it
at a Python lockfile or a pypi: package and it runs the same engine — OSV,
quarantined download, behavioral scan, cited verdict.

What changed

• Python manifests. pkgxray audit now accepts requirements.txt,
  poetry.lock, Pipfile.lock, and pyproject.toml, resolving each to
  PEP 503-normalized name@version deps and querying OSV's PyPI ecosystem.
  Exact pins are vetted; ranges / VCS / URL / editable installs are surfaced as
  unresolved rather than counted safe.
• pypi: guard. pkgxray guard pypi:name@version stages the source
  distribution (a .tar.gz, reusing the npm download + integrity-verify +
  extraction path), pinned to files.pythonhosted.org, and runs the full
  behavioral audit. Wheel-only versions get a metadata-only audit.
• PyPI registry client (src/pypi.js) — package existence (a name PyPI
  never published is the hallucinated/slopsquat signal), version list, and
  metadata mapped onto the same evidence contract the heuristics already use
  (project_urls→repository, ownership.roles→maintainers, yanked→deprecated).
• setup.py / pyproject.toml install-hook detection. pip install of an
  sdist executes setup.py; pkgxray blocks the dropper shape (dynamic exec over
  a decoded or network-fetched payload) and flags generic install-time execution
  (subprocess / custom cmdclass / in-tree backend-path) for review.
• recheck monitors PyPI lockfiles. pkgxray recheck requirements.txt
  now builds pypi: guard refs and pre-vets newer versions with a real PEP 440
  comparator (src/pep440.js) — epochs, pre/post/dev ordering — instead of
  mis-ordering PyPI versions through the semver path. npm lockfiles are
  unaffected.
• Behavioral engine scoped to the languages it models. The shared
  JS-primitive behavioral detectors (env-harvest+network, dynamic-require,
  persistence, credential-access, …) are calibrated for JavaScript and
  false-fire on ordinary Python — a os.environ read read as a token-harvest, a
  lexer's .bashrc filename string as an rc-file write. A top-1000 PyPI scan
  measured a 7.9% heuristic false-block rate driven entirely by these detectors
  on .py. They now skip source in a language the engine doesn't model (Python);
  a Python sdist is audited by the setup.py/pyproject install-hook detectors,
  OSV, metadata/governance, and the language-neutral checks (prompt-injection,
  hidden-unicode) — which still run on every file. A .py a lifecycle script
  actually executes is not skipped. npm scanning is byte-for-byte unchanged
  (npm ships behavioral payloads in .js/.sh/.gyp, none of which are
  gated). Deep per-.py behavioral parity is tracked for a later release.
• PyPI calibration. A committed PyPI benchmark cohort (5 malicious sdist
  droppers + 7 benign shapes) is gated in CI alongside the npm corpus, and
  scripts/validate-at-scale.js --ecosystem pypi proves 0 heuristic false blocks
  across the top-1000 most-downloaded PyPI packages — the same regression-gated
  bar the npm claim rests on.
• No detection change for npm. The shared behavioral engine is untouched for
  npm; ecosystem is threaded file-level from the manifest format. 50 new tests.