[uv New Feature] The Era of Automatic Dependency Vulnerability & Malware Checking with uv Alone Has Arrived

Python package management is now even safer. Introducing `uv audit` and malware checking features

Hello, coolzero here.

The long-awaited security features have been added to uv, which has been showing overwhelming speed in Python dependency management. On June 8, 2026, Astral (the developer of uv) announced the `uv audit` command and automatic malware checking functionality on their official blog. Let's take a look.

Both features are currently considered preview (unstable), but they are must-checks for security-conscious developers and infrastructure engineers.

1. Main New Features

① Addition of the `uv audit` command

• Scans project dependencies (`pyproject.toml` / `uv.lock`)

• Detects known vulnerabilities (including transitive dependencies)

• Warns about "adverse" (deprecated, abandoned, or otherwise undesirable) packages

• Designed as a uv-native alternative to `pip-audit`, it returns a non-zero exit code if findings are present (making it easy to stop in CI)

② Malware checking feature (opt-in)

• During synchronization processes like `uv add` / `uv sync`, it references OSV's MAL advisory (information on known malicious packages)

• If malware is found in the locked dependencies, it interrupts the sync before any malicious code can be executed

• Enabled via the environment variable `UV_MALWARE_CHECK=1` (disabled by default. They are considering enabling it by default in the future)

The importance of this lies in the fact that even if PyPI "quarantines" malware and removes it from the index, it could still be installed if the lock file points directly to object storage; this check closes that loophole during installation.

2. Trying it out (Command Examples)

# 1. audit コマンドで現在の依存関係をチェック
uv audit

# 2. マルウェアチェックを有効化して同期
UV_MALWARE_CHECK=1 uv sync

Regarding speed: According to the official blog, `uv audit` is about 4-10 times faster than pip-audit for typical projects. However, the official documentation notes in a footnote that "the comparison is somewhat 'apples to oranges,' and a pip-audit with a warmed cache can achieve nearly equivalent speeds." While you shouldn't have excessive expectations, the fact that it is integrated into uv and reduces the number of steps without needing additional tools is a definite benefit.

Behavior upon detection (Image):

• Vulnerability found → Displays details of the relevant package and advisory (*Filtering by severity via CVSS is not yet implemented. This is being carefully considered because not all vulnerabilities are assigned a CVSS score).

• Malware detected → Immediately interrupts synchronization (exits with an error).

3. Why is this important now?

• Supply chain attacks on PyPI and similar platforms are on the rise (driven by the bloating of dependency graphs, the annual increase in known vulnerabilities, and the lowered cost of discovering vulnerabilities using LLMs).

• The more dependencies grow, the easier it is for vulnerabilities and malicious packages to be buried.

• `uv audit` returns a failure exit code, making it easy to integrate into CI/CD

• Consistent security checks with just uv, from local development to production deployment are now possible.

This is especially good news for those running local LLMs or custom AI agents in earnest. In configurations where agents automatically install packages using `uv add` or `uv pip install`, the risk of malicious package contamination becomes a realistic threat. By enabling `UV_MALWARE_CHECK=1`, you can secure that entry point.

4. ⚠️ Standalone operation is not enough — Secure with defense-in-depth

This is the most important point I want to convey. `uv`'s malware check is not a "silver bullet." The reason is simple: this check relies on publicly known advisories. Immediately after an attacker releases a new malicious package, it is not yet listed in any database and will slip through.

Therefore, it is realistic to build a defense-in-depth strategy that covers the entry point (at installation) and the execution phase (at runtime) with separate layers.

(a) Use in conjunction with EDR

`uv audit` / `UV_MALWARE_CHECK` is strictly a check at the package acquisition and synchronization stage. If malicious code slips through and is executed, detecting and blocking it based on behavior is the role of EDR (Endpoint Detection and Response). Since the "layer that blocks before installation" and the "layer that catches anomalies after execution" have different scopes, you can only minimize the risk by having both. It is correct to view uv's features as complementary to EDR, not a replacement for it.

(b) Registry Proxy Defense - Takumi Guard (Free)

Another option for strengthening the entry point is Takumi Guard (GMO Flatt Security).

• Registry Proxy Type: You can switch the source for `pip` / `uv` / `poetry` to go through Takumi Guard (`pypi.flatt.tech`) by simply adding one line to your configuration file.

• No account required and free to use.

• Blocks known malicious packages during installation. For authenticated users, it also provides download tracking and breach notifications.

However, there is a trade-off here. As you might expect, since the source changes to `pypi.flatt.tech`, there is a quarantine period of approximately 72 hours (3 days) for newly published packages. In other words, even if a new version is released, there will be a time lag of up to 3 days before it becomes available for you to fetch.

This is not so much a drawback as it is an "intentional delay" based on the same concept as the dependency cooldown recommended by the official uv team mentioned earlier. It is a design philosophy that reduces the risk of being saddled with a brand-new (i.e., not yet vetted by anyone) version by letting it sit for 3 days. That said, it is not well-suited for cases where you "want to use the latest version immediately after release," so you will need to decide whether to prioritize speed or safety based on the nature of your project.

5. Current Notes (Preview Features)

• Both `uv audit` and malware checks are treated as preview (unstable) features.

• There is a possibility of breaking changes in the future.

• The fact that malware checks are disabled by default (opt-in) is a cautious decision to gauge false positives, speed, and behavior.

Future roadmap (some parts are in the planning stage and not yet implemented):

• Dependency resolution that considers vulnerabilities (e.g., choosing solutions with fewer known vulnerabilities during locking)

• `uv add` warning method to avoid alert fatigue by warning only "when newly added dependencies have vulnerabilities".

• Support for data sources other than OSV (PYSEC, ecosyste.ms, etc.)

• Support for `requirements.txt` / `pylock.toml` (PEP 751), machine-readable output like JSON, and `--fix` mode

Summary: It's a preview, but worth trying out now (though don't rely on it alone)

Conclusion: If you care about supply chain security, this is a feature you should start using while it's still in preview. Start with these two.

uv audit
UV_MALWARE_CHECK=1 uv sync

However, to reiterate, this cannot protect you on its own. It is recommended to incorporate it with the premise of defense-in-depth, such as further securing the entry point with a registry proxy (like Takumi Guard) and monitoring runtime with EDR.

Especially recommended for the following people:

• People building local AI/LLM environments, or those who delegate package additions to agents

• Projects with a large number of dependency packages

• Engineers conscious of supply chain security

As this is a preview feature, behavior and options may change in the future. When putting it into actual production, it is safe to start by 'trying it out' in CI or locally while checking the latest documentation.

Official References

• uv Official Blog: https://astral.sh/blog/uv-audit

• uv Command Documentation: https://docs.astral.sh/uv/reference/cli/#uv-audit

• uv Roadmap (Issue #18506 ): https://github.com/astral-sh/uv/issues/18506

• Takumi Guard (GMO Flatt Security): https://flatt.tech/takumi/features/guard

*This article has been verified and corrected based on the Astral official blog, documentation, roadmap, and public information from GMO Flatt Security (as of June 2026). Because this is a preview feature, please check the respective official sources for the latest information.

Hashtags (can be pasted directly into the note tag field)

#uv #Python #PackageManagement #Security #SupplyChainAttack #SupplyChainSecurity #DevSecOps #EDR #AIAgent #LocalLLM #PyPI #TakumiGuard #Astral #Engineer