package-doctor

package-doctor is a Python dependency scanner that detects exploited CVEs and abandoned packages that handle untrusted input, ranking issues by CISA KEV and EPSS scores. It integrates into CI workflows and as a Claude Code hook to block or warn about risky dependencies during installation, helping developers prioritize fixes and avoid vulnerable or unmaintained packages at trust boundaries in their projects.