Using SourceRank score to warn or limit packages

[fungi]

You might be remembering the discussion about having pip-audit
inline with package installation in order to block downloads of
package versions with known security vulnerabilities:

Towards a `pip audit` subcommand for vulnerability analysis & management

Background As part of my day job on Google’s open-source security team, I’ve been working for the past year with a team from Trail of Bits to author, implement and maintain https://pypi.org/p/pip-audit/, a standalone tool for scanning Python environments for packages with known vulnerabilities. This is the first such tool to integrate directly with PyPI for vulnerability data and be intended to be an entirely community-owned and operated project. We’re at the point now where pip-audit is more …