Two different layers: Socket watches a connected dependency graph and the public registries -- including PyPI -- on an ongoing basis across 70+ risk categories. This tool answers one narrower, one-time question from a pasted requirements.txt or the CLI — does this exact release file carry a PEP 740 provenance attestation — with no account and nothing installed.
Socket is a supply-chain security platform. Its own site describes deep package inspection that characterizes what a dependency actually does, connected through a GitHub app, a CLI (Socket publishes its own security CLI on PyPI, confirming Python coverage), or a browser extension, and it flags more than 70 categories of risk across PyPI, npm, and other ecosystems — malware, typosquatting, hidden or obfuscated code, and permission creep among them — while monitoring a project's dependency graph on an ongoing basis. It is free for public, open-source use, and Socket's own site lists paid tiers for private-repository and organization use. This page does not claim to know exactly how Socket weighs or surfaces PEP 740 provenance specifically, since this session cannot verify that live against Socket's own product.
This tool does none of what Socket does. It has no account, no
ongoing service, no GitHub app, and it never scores a package or a
project. Given a pasted requirements.txt,
pyproject.toml, or a plain list of package names, it
makes two read-only GET requests per package to pypi.org
— the same public API pip and
pypi-attestations already talk to — and reports
exactly whether a PEP 740 provenance attestation exists for the
resolved release file: present (published via trusted publishing from
a supported CI) or absent (a classic, stealable API token). Nothing
is uploaded, nothing is connected, and nothing is remembered between
runs beyond what you paste again next time.
| Question | Where to answer it |
|---|---|
| I want continuous, registry-aware scanning of my whole dependency graph for malware, typosquats, permission creep, and dozens of other supply-chain risks — not just publish provenance. | Socket — that is the ongoing, cross-ecosystem job it is built for. |
| I want to know right now, for free, exactly which packages in a pasted requirements file lack a provenance attestation, with no account and nothing connected. | This tool — paste it, get the list, nothing installed. |
| I want a GitHub app or CLI that watches every future pull request for newly introduced supply-chain risk. | Socket — this tool has no memory between runs and watches nothing on its own. |
I want a single, exportable report across several projects' requirements files with no sign-up, wired into a script with --json. | This tool's CLI — paste or point it at each requirements file in turn. |
| I want to know whether a specific package has ever shown malicious behavior, or is a typosquat of a popular name. | Socket — this tool checks one attestation field and cannot answer that. |
| I want the exact PEP 740 attestation field, per release file, with no interpretation or score layered on top. | This tool — that is the one fact it reports, nothing more. |
A team can reasonably run both: Socket for continuous, registry-aware defense against a live attack already under way, and this tool as a fast, zero-account, zero-install check of exactly which dependencies still publish through a stealable token — useful on its own, or before deciding whether Socket's broader connected monitoring is worth setting up at all. This page does not evaluate Socket's detection accuracy or how it weighs provenance and makes no claim about either — it only describes Socket's documented product shape and states what this tool does differently. A clean result from either one is not a guarantee that a dependency is safe: absence of a provenance attestation is a fact about how a release was published, not a verdict, and presence is not a safety guarantee either -- a May 2026 worm shipped malicious PyPI and npm packages carrying valid, verifiable attestations.
This tool needs no account and no sign-up: it is a static page that runs in your browser, or a zero-dependency Node CLI, and every check is two read-only requests per package to the public PyPI API.
Socket's own site describes ongoing, registry-aware monitoring of a connected dependency graph across more than 70 risk categories -- including Python packages, via its own CLI published on PyPI -- through a GitHub app, CLI, or browser extension, so provenance is plausibly one signal folded into Socket's broader scoring for a connected project. This tool does a narrower, one-off thing: given a pasted requirements.txt, pyproject.toml, or plain list, it makes two read-only GET requests per package to the public PyPI API and reports exactly whether a PEP 740 attestation exists for that release file -- no account, no GitHub app, no ongoing connection, and nothing installed.
They sit at different layers. Socket runs on an ongoing basis against a connected project and the public registries, watching for malware, typosquatting, permission creep, and dozens of other supply-chain risks, as a service that is free for public open-source use and offers paid tiers for private and organization use, per Socket's own site. This tool answers one narrower, one-time question with nothing to connect: for the packages in this pasted requirements file or list, which releases were published with a provenance attestation and which still rely on a classic, stealable API token? Free, no account, no install, two read-only PyPI requests per package.
No. This page is not affiliated with, endorsed by, or sponsored by Socket, Inc. Socket is a trademark of Socket, Inc., named here only to describe what this tool is and is not, based on Socket's own publicly documented product.
Open PyPI Provenance Check to check your own requirements file, or read why this exists alongside pypi-attestations verify.