docs: update limitation for pypi registry scanning only

2026-08-03 07:24:09 +02:00 · 2025-06-12 21:05:44 +05:30
parent 5e9f2af972
commit 680439aae3
1 changed files with 10 additions and 0 deletions
@@ -202,3 +202,13 @@ to choose a version from a version range for evaluation. This is fine when all v
 is malicious. However, there is a possibility of inconsistency when a specific version of a package is malicious.

 </details>
+
+<details>
+<summary>PyPI registry scanning only</summary>
+
+`pmg` only scans packages available in the PyPI registry when using `pip`. Packages installed from
+alternative sources such as Git URLs, local file paths, or private registries are not analyzed for
+malware detection. This limitation applies to direct installations and transitive dependencies sourced
+from non-PyPI locations.
+
+</details>