TESIGN / RADAR
2026.09.22
package-doctor

package-doctor

Find the Python dependency to fix first

WHO USES ITDevelopers running Python projects, and teams that want to stop a coding agent from adding a package on its own.

Install to use

Scans Python dependencies and tells you which are being exploited now — and which have no one left to fix them.

INSTALL

START IN 5 MINUTES ↓

Terminal output of package-doctor scan: pillow and litellm flagged under FIX TODAY, with a list below split into replace, mitigate, upgrade and quiet.

TESIGN TAKE

Filtering on two axes — currently exploited, and is anyone left to fix it — rather than just counting advisories is what separates it from a plain scanner.

Activity and discovery evidence

★ 8▲ 4 HNAs of 09-22 03:00 UTC

8 stars · checked on GitHub 09-19 03:09 UTC GitHub check 76 h late · no 7-day star increase observed (GH Archive) (as of 09-22 03:00 UTC) · 4 Show HN points observed 09-22 01:35 UTC

NEW 1h OLD WHEN SEEN

AT A GLANCE

LICENSE: MIT
USAGE: Use, change and redistribute, commercially too. Keep the notice.
LANGUAGE: Python
PLATFORM: cli
ACTIVITY: last commit 5 days ago (2026-09-16) · latest release [unconfirmed] As of 09-19 03:09 UTC
COMMUNITY: contributors [unconfirmed] · open issues [unconfirmed] · made by: [unconfirmed] Reference time unavailable
SOURCES: Show HN
OPEN SOURCE: YES
FIRST SEEN: 2026-09-19 02:09 UTC
CATEGORY: SECURITY · DEV TOOLS

A summary, not legal advice.

WHY IT MATTERS

When one dependency accumulates dozens of advisories, knowing where to start is hard. package-doctor orders them by CISA’s known-exploited list and EPSS scores, and only flags a package to replace when it sits at a trust boundary — parsing or authenticating outside input — and no one is left to patch it. Everything else is marked quiet.

BUILD FROM THIS

Written in Python and installed with pip install package-doctor. It reads uv.lock, poetry.lock, Pipfile.lock, requirements.txt and similar files, and calls the trust-boundary question against a human-reviewed map of roughly 1,500 packages. As a Claude Code hook it blocks a coding agent from installing invented package names, packages published in the last 30 days, or vulnerable/abandoned ones at a boundary. It also runs in CI, as a pre-commit hook, and writes SARIF.

WHO IT'S FOR

Developers running Python projects, and teams that want to stop a coding agent from adding a package on its own.

START IN 5 MINUTES

# Install with pip install package-doctor and run package-doctor scan.

CAVEATS

The trust-boundary call depends on that human-reviewed map of about 1,500 packages, so anything outside it is left unchecked. It covers Python projects only.

RECEIPT

FIRST SEEN: 2026-09-19 02:09 UTC
AT SOURCE: 2026-09-19 00:27 UTC
KEPT: 2026-09-22 05:53 UTC
CREATED → FIRST SEEN: 1h
WHEN FIRST SEEN: 8 ★
SOURCES: Show HN

The same facts in machine-readable form — View as Markdown · JSON

SIMILAR TOOLS

Up to five from SECURITY by ★ total: edited entries first, then repository cards; this entry is highlighted. Drawn from the same stored snapshot as the rankings — a comparison, not a recommendation. As of 09-22 03:00 UTC

NAME	★ TOTAL	▲ 7d	LICENSE	PLATFORM	LAST PUSH
open-code-reviewAI code review for developers	★ 39.2k	▲ +1,146	Apache-2.0permissive	windows · macos · linux · cli	2026-09-21
NucleiScan your servers for known weak spots	★ 31.4k	▲ +8	MITpermissive	cli	2026-09-21
package-doctorFind the Python dependency to fix firstTHIS ENTRY	★ 8	—	MITpermissive	cli	2026-09-16
ente/enteCARD	★ 28.9k	▲ +5	AGPL-3.0copyleft	—	2026-09-13
deskflow/deskflowCARD	★ 28.8k	—	GPL-2.0copyleft	—	2026-09-11

TIMELINE

2026-09-12 22:55 UTCRepository created
2026-09-19 00:27 UTCShow HN post ↗
2026-09-19 02:09 UTCFIRST SEEN BY TESIGN
2026-09-22 05:53 UTCPublished on TESIGN

SAME DAY

01
ZCode
Run multiple coding agents from one app
A coding workspace that runs several AI agents at once and drives a goal to completion.
Use in the browser
★ 5.1k▲ +64 / 7d09-22 03:00 UTC
02
Try Omarchy for Windows
Try the Omarchy Linux desktop on Windows
An app that boots the real Omarchy Linux desktop inside a window on Windows — no VM software to install.
Install to use
★ 440▲ 5 HN09-22 03:00 UTC
03
hibi
A markdown notes app with a graph view
A desktop Markdown editor that also draws a graph of how your notes connect.
Install to use
★ 14▲ 5 HN09-22 03:00 UTC
04
tfm
Drag and drop files inside your terminal
A terminal file manager built for the mouse — drag, drop, dual panes, thumbnails.
Install to use
★ 136▲ +9 / 7d09-22 03:00 UTC
05
AgentMeasure
Audit your Codex and Claude Code logs
Reads your Codex and Claude Code session logs and surfaces repeated failures and retries, with the evidence attached.
Install to use
★ 216▲ 2 HN09-22 03:00 UTC
07
pokertools-arena
Watch AI models play poker at one table
Seats several OpenAI-compatible models at the same poker table and lets you watch every decision as a spectator.
Use in the browser
★ 1▲ 2 HN09-22 03:00 UTC
08
Roastbook
Log espresso shots on your own server
A self-hosted coffee journal that reads a photographed bag’s label and fills in the details for you.
Self-host
★ 2▲ 1 HN09-22 03:00 UTC
09
Comic Chat for AI
Turn a ChatGPT chat into a comic strip
A revival of Microsoft’s old Comic Chat that automatically draws a ChatGPT conversation as a comic strip.
Install to use
★ 1▲ 3 HN09-22 03:00 UTC
10
2049 — Mines of Merge
2048 fused with Minesweeper in a dungeon
You are the tile: slide by 2048 rules while dodging Minesweeper-style hidden mines down eight depths.
Use in the browser
★ 0▲ 1 HN09-22 03:00 UTC