GuardDog (malicious packages)

Checks the npm and PyPI dependencies declared in package.json and requirements*.txt for malicious packages with DataDog GuardDog. guarddog downloads each dependency (the highest version matching its range) from the public registry and analyses it statically with YARA rules and registry-metadata heuristics such as typosquatting; nothing is installed or run. Only a sanitised copy of each manifest, holding registry dependencies, is passed to it from a scratch directory. Opt-in because it downloads every dependency and sends their names to the registries.