Vulnerability and malware checks in uv

Astral is announcing two new security features for uv, the Python package manager. First, `uv audit` is a new command that scans Python dependencies for known vulnerabilities and adverse project statuses using OSV, positioning itself as a faster (4–10x) native alternative to pip-audit. Second, an experimental malware detection feature can be enabled via `UV_MALWARE_CHECK=1`, which performs a lightweight OSV-based check on every sync operation to block installation of known malicious packages before they can execute. The post explains why malware requires a different approach than vulnerability scanning — malware demands immediate remediation and can bypass PyPI quarantine via lockfile direct references to object storage. Future plans include vulnerability-aware dependency resolution, reachability-based alert filtering to reduce alert fatigue, and support for additional vulnerability backends and packaging formats.