Vulnerability and Malware Checks Integrated into uv

2026-07-02

The `uv` tool now includes two new features to bolster supply chain attack protection. `uv audit`, a native function similar to `pip-audit`, scans dependencies for known vulnerabilities and flags adverse project statuses. Additionally, a new environment variable enables a light malware scan during `uv add` or `uv sync` operations, checking the OSV for any malicious advisories on packages.