SODIM

I was going through the security news when i stumbled upon "typosquatting". I was carried away with the potential it had and no real way to avoid it as such. I spent months thinking about how this can be avoided, after digging deep i found out that the pypi community was working on it and there were pretty good suggestions on how to avoid such vulnerabilities, but all of them were about how to keep such malware away from the pypi.

But then i realised, what about the companies and startups who already have a huge 100s of dependent packages based applications running in production, how will a company go back to figure out if their application dependencies are secure or not? Thats how the SODIM was born.

SODIM stands for : Simple Offline Dependency Installation Manager. There are alot of things which SODIM does. It not only tells you if the application is secure or not, it also finds the source code url, download url, repo stars and much more so that someone can easily understand if there is anything concerning in their dependencies. SODIM also expands the dependency list to find out the nested dependencies and run analysis up until the last dependency. With SODIM companies and professionals can easily manage the third party packages inventory installed with them and get notified whenever there is a security update for any of the packages.