Thanks for posting this! I'm the lead developer. I've been building Packj to empower developers/security engineers to easily audit third-party open-source dependencies for supply chain attacks. Please allow me to highlight a couple of important aspects of the technology:

- It analyzes Python/NPM/Rubygems packages for several risky code and attributes such as Network/File permissions, expired email domains, data exfiltration, mismatching repo code vs packaged code (provenance)

- Auditing hundreds of direct/transitive dependencies manually is impractical, but Packj can quickly point out if a package accesses sensitive files (e.g., SSH keys), spawns shell, sends telemetry info, is abandoned, lacks 2FA, etc.

- It can be customized to your threat model by commenting out alerts that don't apply.

- We found a bunch of malicious packages on PyPI using the tool, which have now been taken down; a few are listed here https://packj.dev/malware