Metadata-Version: 2.4
Name: litellm-supply-chain-auditor
Version: 0.1.0
Summary: Security auditor for LLM library supply chains - detects compromised PyPI packages
Project-URL: Homepage, https://github.com/zachos-dev/litellm-supply-chain-auditor
Project-URL: Issues, https://github.com/zachos-dev/litellm-supply-chain-auditor/issues
Author-email: ZachOS <zach@zachos.dev>
License-Expression: MIT
License-File: LICENSE
Keywords: audit,langchain,litellm,llm,security,supply-chain
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Requires-Python: >=3.9
Requires-Dist: click>=8.1.0
Requires-Dist: cryptography>=41.0.0
Requires-Dist: jinja2>=3.1.0
Requires-Dist: packaging>=23.0
Requires-Dist: pyyaml>=6.0
Requires-Dist: requests>=2.31.0
Requires-Dist: rich>=13.0.0
Requires-Dist: toml>=0.10.2
Provides-Extra: dev
Requires-Dist: black>=23.0.0; extra == 'dev'
Requires-Dist: pytest-cov>=4.1.0; extra == 'dev'
Requires-Dist: pytest>=7.4.0; extra == 'dev'
Requires-Dist: ruff>=0.1.0; extra == 'dev'
Description-Content-Type: text/markdown

# litellm-supply-chain-auditor

**Scan Python projects for compromised LLM dependencies. Think `npm audit` for your AI stack.**

## What is this?

A CLI tool and GitHub Action that detects malicious or compromised versions of popular LLM libraries (LiteLLM, LangChain, LlamaIndex) in your Python projects. It verifies package integrity against known-good hashes, cross-references against CVE databases, and generates detailed security audit reports—all designed to address the real supply chain vulnerabilities affecting AI teams today.

## Features

- **Dependency Scanning**: Analyzes `requirements.txt`, `pyproject.toml`, and `poetry.lock` files
- **Hash Verification**: Validates package integrity against PyPI records and historical snapshots
- **CVE Detection**: Real-time integration with GitHub Advisory Database for known compromises
- **Blast Radius Analysis**: Visualize dependency trees to understand the impact of compromised packages
- **GitHub Action**: Drop-in CI/CD integration for continuous monitoring
- **Security Reports**: Generate detailed audit reports with remediation guidance
- **Pre-commit Hook**: Catch vulnerable dependencies before they're committed

## Quick Start

### Installation

```bash
pip install litellm-supply-chain-auditor
```

### Basic Usage

```bash
# Scan your project
litellm-auditor scan

# Scan a specific directory
litellm-auditor scan --path /path/to/project

# Generate a full audit report
litellm-auditor audit --output report.pdf

# Verify specific package versions
litellm-auditor verify litellm==1.0.0
```

### GitHub Action

Add to `.github/workflows/security.yml`:

```yaml
name: LLM Supply Chain Audit
on: [push, pull_request]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: your-org/litellm-supply-chain-auditor@v1
        with:
          fail-on-vulnerability: true
```

### Pre-commit Hook

Add to `.pre-commit-config.yaml`:

```yaml
- repo: https://github.com/your-org/litellm-supply-chain-auditor
  rev: v1.0.0
  hooks:
    - id: litellm-audit
```

## Usage Examples

```bash
# Scan and display results in terminal
$ litellm-auditor scan
✓ Requirements parsed: 24 dependencies
⚠ Checking against CVE database...
✗ CRITICAL: litellm 0.1.911 is known compromised
  → Upgrade to 0.1.912 or later
  → See: https://github.com/advisories/...

# Export detailed JSON report
$ litellm-auditor scan --format json --output audit.json

# Strict mode: fail if any vulnerability found
$ litellm-auditor scan --strict
```

## Tech Stack

- **Language**: Python 3.8+
- **CLI Framework**: Click
- **Data Format**: Rich for terminal output
- **API Integration**: Requests (GitHub Advisory Database)
- **Testing**: pytest
- **Packaging**: pyproject.toml (setuptools)
- **CI/CD**: GitHub Actions

## Monitored Packages

- LiteLLM
- LangChain
- LlamaIndex

See [MONITORED_PACKAGES.md](MONITORED_PACKAGES.md) for the complete list and update cadence.

## Contributing

We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

## License

MIT License — see [LICENSE](LICENSE) for details.