The LiteLLM supply-chain attack via malicious .pth file made me realize how exposed pip install still is.
Pipguard is a lightweight, zero-config tool that scans packages before installation and blocks obvious malware patterns.
Tested it locally — it caught several red flags instantly.
https://pypi.org/project/pipguard/
Source: https://github.com/shenxianpeng/pipguard