uv audit vs pip-audit, and a gate narrower than it looks

Short summary

A hands-on comparison of uv audit and pip-audit against the same vulnerable lockfile, plus a deep dive into uv's new UV_MALWARE_CHECK install-time gate. Both features compare package names and versions against the OSV database rather than analyzing file contents — like a no-fly list, not an X-ray. The security boundary is narrower than the announcement implies: unknown threats not yet in OSV pass through unchecked.

• •uv audit scans lockfiles against OSV vulnerability records; UV_MALWARE_CHECK blocks known malicious packages at install time
• •Neither feature inspects package contents — both match against a name-and-version blocklist
• •Security boundary is narrower than expected: novel or unreported threats are not caught

Generated with AI, which can make mistakes.