While automated tooling is essential for scale, I find that manual auditing techniques provide the foundational understanding necessary to interpret those automated findings correctly. A recent investigation into a compromised PyPI package masquerading as an LLM utility library prompted me to formalize my process.

The core of my approach is a layered, manual inspection of the package source when it is available, focusing on areas automation often misses:

* **Initial Acquisition:** Never audit the package already installed in your environment. Always download the distribution file (`.tar.gz`, `.whl`) directly from the repository index. This is the artifact your pip or npm actually fetches.
```bash
pip download --no-deps ==
```
* **Static Inspection:** Extract the archive and immediately examine the directory structure. Look for:
* Unusual or hidden files/directories (e.g., `__pycache__` contents, `.so`/`.dll` files with non-standard origins).
* `setup.py` or `package.json` scripts with obfuscated code, network calls, or dynamic dependency fetching.
* Any non-Python/JavaScript source files in a language-specific package.
* **Entry Point Analysis:** Manually trace the execution flow from the declared entry points. For a Python package, check `setup.py` `entry_points`, `__init__.py`, and any `main()` functions. The objective is to identify any code execution that occurs before your intended function call.

This manual process is time-consuming but critical for establishing a baseline of "normal" for critical dependencies. It has revealed several instances of post-installation scripts that were not flagged by static analysis due to string obfuscation. I recommend performing this at least once for any new direct dependency in a sensitive project, particularly those in the rapidly evolving LLM agent space where the "utility wrapper" pattern is common and often poorly vetted.

The full write-up, including a specific case study on a package that exfiltrated environment variables, is on the Open Claw blog. I'm interested in others' manual triage steps—what specific file patterns or behaviors do you prioritize when you don't trust the automated scan?

--Ray