Snyk CLI Python Plugin

3.2.1 · active · verified Wed Apr 22

The `snyk-python-plugin` is an npm package that serves as a vital extension for the Snyk Command Line Interface (CLI), enabling it to detect and report known vulnerabilities within Python projects. Currently stable at version 3.2.1, this plugin integrates seamlessly with common Python dependency management tools such as `pip` (via `requirements.txt`), `pipenv` (with `Pipfile`), and `poetry` (using `pyproject.toml` and `poetry.lock`). It focuses on providing comprehensive dependency metadata to the Snyk CLI, which then performs vulnerability analysis. The package maintains a frequent release cadence, typically issuing bug fixes and minor feature enhancements multiple times a month, as evidenced by its recent update history. Its key differentiator is the specialized support for various Python ecosystem nuances, offering deep scanning capabilities that complement the Snyk CLI's broader security analysis.

Common errors

Warnings

Install

Imports

Quickstart

Demonstrates how to use the Snyk CLI with the Python plugin to scan a Python project's `requirements.txt` for vulnerabilities and parse the JSON output.

import { exec } from 'child_process';
import * as path from 'path';
import * as fs from 'fs';

// This quickstart demonstrates how to use the Snyk CLI with the Python plugin
// to scan a basic Python project for vulnerabilities. First, ensure you have
// Snyk CLI and Python (with pip) installed globally.

// 1. Create a dummy Python project directory
const projectDir = path.join(__dirname, 'temp-python-project');
if (!fs.existsSync(projectDir)) {
  fs.mkdirSync(projectDir);
}

// 2. Create a simple requirements.txt with known vulnerable packages
// For demonstration, 'requests==2.25.1' and 'flask==2.0.0' contain known vulnerabilities.
const requirementsContent = 'requests==2.25.1\nflask==2.0.0';
fs.writeFileSync(path.join(projectDir, 'requirements.txt'), requirementsContent);

// 3. Run Snyk CLI with the Python plugin on the created file
console.log(`Scanning Python project in: ${projectDir} using requirements.txt`);
exec(`snyk test --file=${path.join(projectDir, 'requirements.txt')} --json`, { cwd: projectDir }, (error, stdout, stderr) => {
  // Snyk CLI typically exits with a non-zero code if vulnerabilities are found,
  // so 'error' might contain details even if the scan was successful in finding vulns.
  if (error && !stdout.includes('vulnerabilities')) {
    console.error(`Snyk CLI execution error: ${error.message}`);
    console.error(`Stderr: ${stderr}`);
    fs.rmSync(projectDir, { recursive: true, force: true });
    return;
  }

  try {
    const jsonOutput = JSON.parse(stdout);
    console.log('Snyk scan results (summary):');
    if (jsonOutput.vulnerabilities && jsonOutput.vulnerabilities.length > 0) {
      console.log(`Found ${jsonOutput.vulnerabilities.length} vulnerabilities.`);
      jsonOutput.vulnerabilities.slice(0, 3).forEach((vuln: any) => {
        console.log(`- ${vuln.title} in ${vuln.package} (severity: ${vuln.severity})`);
      });
    } else {
      console.log('No vulnerabilities found or parse error occurred.');
    }
  } catch (parseError) {
    console.error('Failed to parse Snyk JSON output:', parseError);
    console.error('Raw stdout:', stdout);
  } finally {
    // Clean up temporary files
    fs.rmSync(projectDir, { recursive: true, force: true });
    console.log('Cleaned up temporary project.');
  }
});

view raw JSON →