--- title: "Vulnerability and malware checks in uv" url: https://daily.dev/posts/vulnerability-and-malware-checks-in-uv-wuu9roi2k source_url: https://astral.sh/blog/uv-audit type: article source: "Astral" published: 2026-06-08T15:30:50.294Z updated: 2026-06-09T06:20:21.850Z tags: ["security", "python"] reading_time: 7 upvotes: 47 comments: 5 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Vulnerability and malware checks in uv **[Astral](https://daily.dev/sources/astral-sh)** · 7 min read · 47 upvotes · 5 comments ## Summary Astral is announcing two new security features for uv, the Python package manager. First, `uv audit` is a new command that scans Python dependencies for known vulnerabilities and adverse project statuses using OSV, positioning itself as a faster (4–10x) native alternative to pip-audit. Second, an experimental malware detection feature can be enabled via `UV_MALWARE_CHECK=1`, which performs a lightweight OSV-based check on every sync operation to block installation of known malicious packages before they can execute. The post explains why malware requires a different approach than vulnerability scanning — malware demands immediate remediation and can bypass PyPI quarantine via lockfile direct references to object storage. Future plans include vulnerability-aware dependency resolution, reachability-based alert filtering to reduce alert fatigue, and support for additional vulnerability backends and packaging formats. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@seyoungcho** · 2 upvotes > Yeah please don't be like npm --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python) [View this post on daily.dev](https://daily.dev/posts/vulnerability-and-malware-checks-in-uv-wuu9roi2k)