# Before you pip install: live KarmaDue checks on PyPI packages, explained

Captured 2026-11-11 at 9:01 AM America/New_York (14:01:44 to 14:01:58 UTC) from KarmaDue's public endpoints, with no account and no key. Answers change as advisories, registries, versions and release ages change, so rerun the call before you act rather than trusting this page as current.

Published by KarmaDue (karmadue.expo.app). These are KarmaDue's own outputs, not an independent review.

## When to call

Before `pip install`, `uv add`, `uv pip install`, `pipx install` or adding a line to `requirements.txt` / `pyproject.toml`. Setup code and import-time code in a Python package run with your agent's permissions, so the moment to check is before the install, not after.

## The call

Safety MCP `check`:

    curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp/safety \
      -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
      -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check","arguments":{"target":"pypi:requests==2.31.0","action":"install"}}}'

Use `pypi:name==version` to check an exact pin, or `pypi:name` to check whatever the registry would give you today. Act on `enforce` (`block`, `require_human_approval`, `proceed_with_care`), show `headline` to your person, and read `gaps` for what was not checked.

Default MCP `check_install` (same feeds, plus tested setup recipes where they exist):

    curl -s -X POST https://ogogoizwsfaduzehkshb.supabase.co/functions/v1/mcp \
      -H 'content-type: application/json' \
      -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_install","arguments":{"target":"fastapi","ecosystem":"pypi","runtime_env":"python 3.12 linux"}}}'

## The answers (safety `check`, action "install")

| Target | decision | enforce | What KarmaDue said |
|---|---|---|---|
| `pypi:ctx==0.2.6` | `deny` | `block` | Malicious-package report GHSA-67r3-h899-9w95 ("Embedded Malicious Code in ctx") plus PYSEC-2022-199. `scope.checked` notes the registry no longer has the package, so the verdict comes from the advisory feeds, not the registry. |
| `pypi:requests==2.31.0` | `warn` | `require_human_approval` | 3 published advisories (CVE-2026-25645, CVE-2024-47081, CVE-2024-35195). Fixed in 2.33.0; offered `pypi:requests==2.33.0` as a `fixed_version` alternative. |
| `pypi:jinja2==3.1.2` | `warn` | `require_human_approval` | 5 published advisories; fixed in 3.1.6, offered as `fixed_version`. |
| `pypi:pyyaml==5.3` | `warn` | `require_human_approval` | 2 advisories (CVE-2020-1747, CVE-2020-14343); fixed in 5.4. |
| `pypi:fastapi` (unpinned) | `warn` | `proceed_with_care` | Resolved to 0.162.4, published 20 hours earlier. Releases under 7 days old get a caution because hijacked or broken publishes tend to surface then: pin a version you know works, or wait. |
| `pypi:requests` (unpinned) | `no_known_issues` | `proceed_with_care` | Resolved to 2.34.2 (published 2026-05-14, 351,752,933 downloads last week). "Not safety-reviewed": no report found is not a clearance. |
| `pypi:reqeusts` (typo) | `unverified_existence` | `require_human_approval` | No such package on PyPI. A name that does not exist can be registered later by anyone (slopsquatting). Suggested `requests` as a `close_name`, with "Not checked here: run check on it." |
| `pypi:colourama` (typo of colorama) | `unverified_existence` | `require_human_approval` | No such package on PyPI. A name that does not exist can be registered later by anyone (slopsquatting). Suggested `colorama` as a `close_name`, with "Not checked here: run check on it." (Rechecked 1:01 PM ET after fix94; the 9:01 AM capture had no suggestion.) |

## What `check_install` added

- `fastapi`: same fresh-release caution, plus a tested recipe: `fix` = `pip install "fastapi[standard]"` (or `pip install fastapi uvicorn`), `do_not` = installing bare `fastapi` and then running `python -m uvicorn main:app` (failed with "No module named uvicorn" when tested), `test` = `python -m uvicorn --version`. Source: kd-seed-164, tested 2026-10-14, labeled "Founder-operated assessment, not independent".
- `requests==2.31.0`: `enforce: ask`, all 3 advisory refs and `fixed_in: 2.33.0`; source "registry + OSV advisory feeds; no PinTree test record".
- `reqeusts`: `unverified_existence`, `enforce: ask`, safety verdict `package_not_found`.

## How an agent should use this

1. Check the exact pin you will install. Unpinned checks describe today's latest release, which can change between your check and your install.
2. `block` means do not install. `require_human_approval` means stop and ask your person, showing the headline. `proceed_with_care` means go ahead with normal care, not "safe".
3. A typo-looking name that does not exist is not malware, but do not install it; check the suggested close name separately.
4. For a whole `requirements.txt` in CI, see the batch example in https://karmadue.expo.app/docs/worked-examples.md.

## Limitations seen in these answers

- Three gaps first recorded on this page were closed in the 2026-11-11 fix94 release. A live recheck at 1:01 PM America/New_York the same day confirmed: `evidence` now lists every advisory link (requests 3 of 3, jinja2 5 of 5); `colourama` now suggests `colorama` as a `close_name`; and `similar` alternatives for a single-word name no longer include off-topic results whose only link is that word. Close-name suggestions can still miss some typo shapes. A `similar` alternative is still labeled "Not checked as a drop-in replacement".
- Safety `check` and `check_install` now agree when KarmaDue holds a founder-operated record (for example fastapi, kd-seed-164, labeled "Founder-operated assessment, not independent").
- No check observes runtime behaviour, and packages without a KarmaDue record are assessed only from the registry and advisory feeds.

Raw responses for every row are kept by the KarmaDue maintainer; rerun the calls above to see current answers.