Hey pants, are there any known tools which are able to scan for python packages within a pex binary for vulnerabilties?

I don't know of any off the cuff, but is this a pex binary you own? In which case, auditing the requirements or lockfile could be a start. And then, pex is basically a shim and a zip - so maybe you'd be able to unzip it and use any typical scanners?

mildly related: My org uses xray scan (comes with artifactory, I believe). Since our pex files are built into docker images and its really the scan of the docker images we care about, we make our docker images following the format at https://www.pantsbuild.org/blog/2022/08/02/optimizing-python-docker-deploys-using-pants#multi-stage-build-leveraging-2-pexs Which includes a step to unzip the pex file inside the image. Its all the benefits of building pex files, but you still end up with regular-looking python stuff in the docker image, (so it works still with a normal scanner)

And it builds/runs faster to boot