Question 1

What if a transitive dependency has a vulnerability but the direct parent doesn't?

Accepted Answer

You're still responsible. In Python, transitive dependencies are where most vulnerabilities hide — requests alone brings in 4 packages. Update the parent package (preferred) or pin the transitive dependency directly in your lock file. Use pip-compile or poetry update to resolve the chain cleanly.

Question 2

My project uses setup.py with install_requires — can I scan it?

Accepted Answer

Yes, but with caveats. setup.py declares abstract version ranges (requests>=2.0), which can't be mapped to specific vulnerable versions without resolution. GeekWala will attempt to parse it, but results are more accurate with a lock file. Run pip freeze > requirements.txt from your virtualenv for a snapshot scan.

Question 3

A vulnerability was published, but my scanner didn't catch it — why?

Accepted Answer

Python's advisory fragmentation means vulns can appear in NVD days before OSV, or vice versa. GeekWala queries multiple databases to minimize this gap, but propagation takes 24-48 hours. For C extension vulnerabilities (numpy, pillow, cryptography), NVD often leads — these may not appear in PyPI advisories at all.

Question 4

Does GeekWala work with private PyPI repositories?

Accepted Answer

Not yet. GeekWala scans against public PyPI + OSV databases. Private packages are checked based on their declared version against known CVEs. If your private package wraps a public library, vulnerabilities in the public library are still detected. Enterprise private registry support is planned.

Question 5

I have 50+ vulnerabilities — where do I start?

Accepted Answer

Filter for CISA KEV entries first, then sort by EPSS descending. For the full prioritization framework, see our EPSS deep dive. For Python specifically, also prioritize C extension libraries (cryptography, numpy, pillow) higher, since their vulnerabilities often involve memory safety issues that bypass Python's protections.

Question 6

Can I use pip-audit --fix and then verify with GeekWala?

Accepted Answer

That's a solid workflow. pip-audit --fix attempts automatic resolution within your virtualenv. After fixing, regenerate your lock file and rescan with GeekWala to verify the fix didn't introduce new transitive vulnerabilities — which happens more often than you'd expect in deep Python dependency trees.

Question 7

Does GeekWala support conda or mamba environments?

Accepted Answer

GeekWala doesn't parse environment.yml or conda lock files directly — conda uses its own package format and registry separate from PyPI. However, most conda environments also have pip-managed packages. Export those with pip freeze > requirements.txt (run from within your activated conda environment) and scan the requirements file. For pure conda packages (channels like conda-forge or defaults), use jake (Sonatype's open-source conda scanner) or the anaconda audit scan command if you're on the Anaconda commercial platform. Mamba works the same way since it's a drop-in conda replacement.

See Dependency Security Across 8 Ecosystems for how Python fits into multi-language stacks. For a side-by-side comparison of all ecosystem scanners, see 7 Dependency Vulnerability Scanners Compared.

> 2026 Supply Chain Alert: PyPI continues to be a high-value target for supply chain attacks — in early 2026, researchers discovered multiple waves of malicious packages impersonating popular libraries. If your Python projects pull from PyPI, read Supply Chain Attacks on Open Source in 2026 for the latest attack patterns and defenses.