Known vulnerabilities are tracked in OSV and the Python Packaging Advisory Database. For CI, use pip-audit. To preview a package before install, open it on PyDeps for live OSV checks, fix versions, KEV/EPSS signals, health grades, and a subtree rollup of risk in the dependency graph.
pip-audit and pip-audit -r requirements.txt gate lockfiles in pipelines.
Open a package page to review advisories on the header, expand the tree for transitive risk, then optionally download an offline bundle only after you accept the posture.