I've been building tooling to mitigate open-source supply chain attacks. Packj [1] analyzes Python/NPM packages for risky code and attributes such as Network/Fi

I've been building tooling to mitigate open-source supply chain attacks. Packj [1] analyzes Python/NPM packages for risky code and attributes such as Network/File permissions, expired email domains, etc. Auditing hundreds of direct/transitive dependencies manually is impractical, but Packj can quickly point out "risky" attributes that must be checked. We found a bunch of malicious packages on PyPI using the tool, which have now been taken down; a few are listed here https://packj.dev/malware https://packj.dev/malware Would love to get your feedback. 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj