Security & supply chain¶
This page is for the security and platform teams who vet what gets past a corporate package firewall (Sonatype Nexus, JFrog Curation, Socket, Snyk, and similar). It gathers oryxflow's provenance, its clean-vulnerability status, and the public entries you can check yourself, so approving oryxflow doesn't need a back-and-forth.
At a glance¶
- No known vulnerabilities. oryxflow has no CVEs or advisories in any public database.
- Named publisher, permissive licence. Published by Oryx Intelligence LLC under the MIT licence, from a public source repository.
- Small, tier-one dependency set. Five direct dependencies, all mainstream and widely
audited:
pandas,pyarrow,openpyxl,markdown,loguru. - Clean own-code scores. Socket rates oryxflow's own package 100 on Vulnerability, Quality, Maintenance and Licence. The only open alert is inherited from a dependency, not oryxflow's code — see Known dependency alerts.
Verify it yourself¶
Every claim above is checkable from a public source — no need to take our word for it:
| Source | What it tells you | Link |
|---|---|---|
| PyPI | Publisher, versions, licence, release history | pypi.org/project/oryxflow |
| OSV.dev | Aggregated vulnerability database (GHSA, PyPA, NVD) | osv.dev |
| Snyk | Vulnerabilities, licence, health score | security.snyk.io/package/pip/oryxflow |
| deps.dev (Google) | Dependency graph, advisories, scorecard | deps.dev/pypi/oryxflow |
| Socket | Behavioural supply-chain analysis | socket.dev/pypi/package/oryxflow |
| Source | Full source, issues, history | github.com/oryxintel/oryxflow |
Dependencies¶
oryxflow keeps its dependency footprint deliberately small. The core install pulls in only:
- pandas, pyarrow — dataframes and Parquet/Arrow I/O
- openpyxl — Excel I/O
- markdown — Markdown report output
- loguru — logging (off by default; see Logging)
Everything else — cloud storage (gcs/s3), Dask, flow export — is an opt-in
install extra, so you only bring in what you use.
Known dependency alerts¶
Behavioural scanners occasionally raise a flag on a dependency. For completeness, here is the one you may see, and why it is not a concern:
loguru — Obfuscated code / AI-detected potential security risk
Both alerts point at the same file in loguru (not oryxflow): loguru/_recattrs.py,
the RecordException class. loguru makes log records picklable so they survive being passed
between processes (loguru's enqueue=True option), and the scanner flags that nested-pickle
pattern as a potential deserialization risk.
This is a false positive for oryxflow's usage: the risk only exists if an attacker can feed untrusted pickle bytes into the deserializer, and oryxflow never deserializes untrusted input through loguru. The alert's own notes confirm the module "contains no explicit exfiltration or network behavior." loguru is one of the most-downloaded Python packages and is widely audited.
If your policy engine requires a disposition, this alert can be accepted/ignored with the justification: "False positive — trusted upstream dependency (loguru); no untrusted deserialization path in use."
Requesting an allowlist entry¶
New packages with low download history are sometimes auto-quarantined by reputation/age policies even when their security record is clean. If oryxflow is held by such a policy in your environment, point your reviewer at this page and the public sources above, or reach out at dev@oryxintel.com and we'll help provide whatever your process needs.