PyPI 正被 AI 生成的包淹没——每周发布量暴涨 30%，你的依赖还安全吗？

"""
dep_guard.py — 扫描项目依赖中的高风险包
用法: python dep_guard.py requirements.txt
依赖: pip install requests
"""

import sys
import json
from datetime import datetime, timedelta
import requests

PYPI_API = "https://pypi.org/pypi/{name}/json"
RISK_THRESHOLD_DAYS = 30  # 包龄低于此值视为高风险

def check_package(name: str) -> dict:
    """从 PyPI API 拉取包元数据，返回风险评估结果"""
    resp = requests.get(PYPI_API.format(name=name), timeout=10)
    if resp.status_code != 200:
        return {"name": name, "status": "not_found_on_pypi", "risk": "high"}

    data = resp.json()
    info = data.get("info", {})
    releases = data.get("releases", {})

    # 计算包龄：取最早版本的发布时间
    first_release_date = None
    for ver, files in releases.items():
        for f in files:
            dt = datetime.fromisoformat(f["upload_time_iso_8601"].replace("Z", "+00:00"))
            if first_release_date is None or dt < first_release_date:
                first_release_date = dt

    age_days = (datetime.now(first_release_date.tzinfo) - first_release_date).days if first_release_date else -1

    # 维护者数量（PyPI JSON API 不直接返回，用 author 字段粗估）
    author_raw = info.get("author") or ""
    maintainer_raw = info.get("maintainer") or ""
    people = set()
    for field in [author_raw, maintainer_raw]:
        if field:
            # 简单按逗号/分号拆分
            for p in field.replace(";", ",").split(","):
                p = p.strip()
                if p:
                    people.add(p)

    # 最新版本号
    latest_ver = info.get("version", "0.0.0")

    # 风险判定
    risks = []
    if 0 < age_days < RISK_THRESHOLD_DAYS:
        risks.append(f"包龄仅 {age_days} 天")
    if len(people) <= 1:
        risks.append("维护者仅 1 人")
    # 版本号异常高（如刚发布就是 99.0.0）——依赖混淆常见手法
    try:
        major = int(latest_ver.split(".")[0])
        if major >= 50 and age_days < 365:
            risks.append(f"版本号 {latest_ver} 异常偏高")
    except ValueError:
        pass

    return {
        "name": name,
        "age_days": age_days,
        "maintainers": len(people),
        "latest_version": latest_ver,
        "risk": "high" if risks else "low",
        "risk_details": risks,
    }

def main():
    if len(sys.argv) < 2:
        print("用法: python dep_guard.py requirements.txt")
        sys.exit(1)

    with open(sys.argv[1]) as f:
        names = [line.strip().split("==")[0].split(">=")[0].split("<=")[0].split("~=")[0]
                 for line in f if line.strip() and not line.startswith("#")]

    print(f"扫描 {len(names)} 个依赖包...\n")
    flagged = []
    for name in names:
        result = check_package(name)
        status_icon = "⚠️" if result["risk"] == "high" else "✅"
        print(f"{status_icon} {result['name']}  龄={result['age_days']}天  维护者={result['maintainers']}  版本={result['latest_version']}")
        if result["risk"] == "high":
            for detail in result["risk_details"]:
                print(f"   → {detail}")
            flagged.append(result)

    print(f"\n高风险包: {len(flagged)}/{len(names)}")
    if flagged:
        print("建议逐一审查，确认是否为必要依赖。")

if __name__ == "__main__":
    main()

# 先安装 requests（脚本自身依赖）
pip install requests

# 扫描你的 requirements.txt
python dep_guard.py requirements.txt

# 只安装包龄超过 90 天的包（需要 pip 21.1+）
pip install --no-deps some-package  # 先不拉依赖，手动审查后再装

# 用 pip-audit 检查已知漏洞
pip install pip-audit
pip-audit  # 扫描当前环境所有依赖的已知 CVE