mkbhardwas12/pwned-deps
Scan lockfiles for compromised package versions (MAL-* / EXTRA-*).
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 5, 2026
- License
- Apache 2.0
Pinned Snippet
uses: mkbhardwas12/pwned-deps@9ee455611e17ecb8fe7380e4ff472bee6e7b68ce # v0.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan (file or directory). Directories autodetect every supported lockfile. | no | . |
| version | Which pwned-deps to install. Empty (default) - `pip install pwned-deps` (latest from PyPI). "1.2.3" - `pip install pwned-deps==1.2.3` (pinned). "from-source" - install the action's own checkout via pip install -e <action checkout path>. Used by this repo's action self-test before first PyPI publish, and by forks doing local development against an unreleased revision. | no | "" |
| fail-on | Which exit codes fail the step. `compromised` (default) — fail on exit 1 only. `any` — fail on exit 1 or 2. `never` — never fail (report-only). | no | compromised |
| output-sarif | Path to write the SARIF report. Empty = do not write SARIF. | no | pwned-deps.sarif |
| upload-sarif | If `true`, upload the SARIF file to GitHub Code Scanning. | no | true |
| offline | If `true`, skip the network and use the cached database only. | no | false |
Outputs
| name | description |
|---|---|
| exit-code | The CLI exit code (0/1/2/3). |
| sarif-path | Path to the SARIF file written, if any. |