Use pip's dry run mode to print what would be installed without installing it, add a JSON report to record exactly what pip resolved, or use pip download to fetch the files into a folder for inspection. Each lets you review a package's full dependency set before it touches your environment.
Three previews
| Method | What it does | Best for |
|---|---|---|
| Dry run | Prints what would be installed and installs nothing | Quick look at the dependency list |
| Report | Writes a JSON file describing what pip did or would do | Saving the resolved set for review or scanning |
| Download | Collects the downloaded files into a folder instead of installing | Inspecting the actual archives |
The pip reference describes dry run as: do not actually install anything, just print what would be. It can be set with the environment variable PIP_DRY_RUN. The report option generates a JSON file describing what pip did, writes to standard output if the name is a dash, and pairs well with quiet mode so logging does not mix into the JSON. The documentation says both dry run and report can be combined with an option that ignores installed packages to resolve the requirements as if from scratch.
Download without installing
pip download performs the same resolution as install but saves the distributions to the directory you give, or the current directory by default. You can open the archives, list their contents, and read any build files before you decide.
python -m pip download SomePackage
Add the option to skip dependencies when you want only the one package. For other platforms, the documentation says binary only downloads or no dependencies is required when you use the cross platform options.
A review routine
- Run a dry run with the report to see the full tree.
- Compare the list with what you expected. Unfamiliar names deserve a look.
- Download the files for any package that is new to you.
- Check the name for lookalikes. See PyPI name normalization and lookalike packages.
- Install only after that, preferably into a fresh environment.
What preview cannot tell you
A dry run shows names and versions. It does not tell you if a package is malicious. Source distributions may run build code when installed, see wheel or source: what runs on your machine. Metadata for a package from an index may also be derived by parsing file names, so treat the preview as a guide.
Quick check
Does a dry run download packages?
It resolves what would be installed. Use pip download when you want the files themselves.
Can the report be scanned?
Yes. It is JSON that records what pip resolved, so it is a convenient input for review.
Safeguard's dependency scanning can check a resolved package set, with a free scan available.
Sources
Last reviewed: 19 October 2026.
