CRA Index / PyPI / pyasn1-modules
pyasn1-modules and the Cyber Resilience Act
2 of 3 readable security signals are in place for pyasn1-modules 0.4.2 (PyPI). Data checked 2026-10-05.
- passNo known vulnerabilities in the latest version: none listed (Annex I, Part II: address and remediate vulnerabilities without delay)
- passNot deprecated: not marked as deprecated (support period and updates)
- unknownActively maintained: no Scorecard data (security updates for the whole support period)
- unknownSecurity policy: no Scorecard data (Annex I, Part II: coordinated vulnerability disclosure policy and contact address)
- missingLicence declared: non-standard (component documentation and licence notices)
- unknownCode review before merge: no Scorecard data (secure development process (Annex VII, development and vulnerability handling processes))
- unknownCI workflow hygiene: no Scorecard data (integrity of the build and update chain)
- unknownSigned releases or provenance: not assessed (Annex I, Part II: secure distribution of updates)
- unknownAutomated security testing: no Scorecard data (Annex I, Part II: effective and regular tests and reviews)
pyasn1-modules 0.4.2 is the current default version of this PyPI package, published on 2025-03-28. The registry lists 245 versions in total and the licence declared is non-standard. The source repository is pyasn1/pyasn1-modules with 9 stars.
There is no OpenSSF Scorecard result for this package, so the repository signals (maintenance, security policy, code review, workflow hygiene, testing) are unknown rather than missing.
As of 2026-10-05, deps.dev lists no known advisories for this version. That is a snapshot and not a promise: new advisories can be published at any time.
If you ship a product that includes pyasn1-modules, the Cyber Resilience Act expects you to know which components you ship, to follow their vulnerabilities and to exercise due diligence on third-party components (Annex I, Part II and Article 13). In practice: list pyasn1-modules 0.4.2 in your SBOM with its package URL pkg:pypi/[email protected], watch for new advisories, and keep the upstream security contact in your vulnerability handling process.
Put the badge in your README
Check your own project
Run the repository check on pyasn1/pyasn1-modules, or check your own SBOM and create the licence notices.
More in the index
mdurl, jsonschema-specifications, beautifulsoup4, grpcio-status, hatchling, httpx · all PyPI packages
Sources and method
Package and version facts, licences, advisories and provenance: deps.dev (generated data under CC BY 4.0; advisories from OSV). Repository signals: the OpenSSF Scorecard. We read them on 2026-10-05 and show them without scoring the people behind a project. The nine signals are our selection; unknown means the data is not published.
Information generated from your inputs, with article references to Regulation (EU) 2024/2847. It is not legal advice and does not replace your own assessment; check the references against the Official Journal.