TLDR Tech / InfoSec
Vulnerability and malware checks in uv
Astral has shipped two preview security features in the uv Python package manager: uv audit, a native dependency scanner for known vulnerabilities and adverse project statuses that runs 4x to 10x faster than pip-audit by leveraging uv's locked resolutions, and an opt-in OSV-based malware check (enabled via UV_MALWARE_CHECK=1) that queries MAL advisories on every sync to abort installation before quarantined-but-still-fetchable malicious distributions execute. The malware check closes a specific gap in locking installers where lockfiles reference object storage directly, allowing distributions removed from the PyPI index to still install from their underlying storage URLs.
Read the full story