Replaced 12 Third-Party Packages with Python Stdlib

1. What I Built by Hand

I made a standalone Linux administration and security auditing tool called Linux_sys_admin.py. Attacks on Linux servers are so common nowadays and privilege escalation (LPE) is a constant headache. Admins usually end up running dozens of separate commands or writing messy bash scripts just to inspect the kernel state. My script brings security checking user audits current process inspection and file tracking into one place with zero third-party libraries

The script requires root permissions so it can safely read system-level files and kernel vfs(/proc). It checks things like duplicate accounts with UID 0 world-writable files(perm:777) SUID and SGID binaries and listening sockets(TCP/UDP).

2. Zero-Dep Verification Proofs

I have also made a python file for checking third-party packages in a python script and spotting it out :

First is verify_stdlib.py. It uses Python's own AST engine to parse every single import statement in the source code and validates each module against sys.stdlib_module_names. If a third-party module secretly get's imported in the test shows an error.

Second is deps-proof.txt which records the clean environment footprint.

Here is the actual check from verify_stdlib.py that walks the AST and flags anything that is not in sys.stdlib_module_name :

import ast
import sys

def find_bad_imports(filepath):
    """Walks the AST and flags any import that is not stdlib"""
    with open(filepath, "r") as f:
        tree = ast.parse(f.read(), filename=filepath)

    stdlib = sys.stdlib_module_names
    bad = []

    for node in ast.walk(tree):
        if isinstance(node, ast.Import):
            for alias in node.names:
                root = alias.name.split(".")[0]
                if root not in stdlib:
                    bad.append(root)
        elif isinstance(node, ast.ImportFrom):
            if node.module:
                root = node.module.split(".")[0]
                if root not in stdlib:
                    bad.append(root)

    return bad

If this returns an empty list the script is clean.

3. What Packages I Would Normally Reach For

If this were an everyday project without zero-dependency constraints I would have immediately reached for:

psutil • watchdog • click • rich • colorama • tabulate • sdbus • systemd-python • pyyaml • filelock • xxhash • argcomplete

4. What It Actually Took to Replace Them

Swapping out those packages meant writing the underlying logic by hand. Here is the full breakdown of decisions and tradeoffs:

In total this ended up replacing 12 packages with a few hundred extra lines of stdlib code that I wrote by hand and when I checked pip list before and after there was nothing left to install at all so a fresh clone runs on any box with just python3 and no requirements.txt needed.

Replacing psutil for Process Reading in Code

With psutil installed this would have been one line like psutil.process_iter() and it hands you back memory and CPU fields ready to use. Here is the actual chunk from my script reading /proc directly instead since that comparison is really the whole point of this writeup:

def read_proc_file(path):
    try:
        with open(path, "r") as f:
            return f.read()
    except (FileNotFoundError, PermissionError, OSError):
        return None

def audit_processes():
    proc_path = "/proc"
    processes = []

    for entry in os.listdir(proc_path):
        if not entry.isdigit():
            continue

        pid = entry
        status = read_proc_file(os.path.join(proc_path, pid, "status"))
        cmdline = read_proc_file(os.path.join(proc_path, pid, "cmdline"))

        if status is None:
            continue

        name = pid
        uid = "?"

        for line in status.splitlines():
            if line.startswith("Name:"):
                name = line.split(":", 1)[1].strip()
            elif line.startswith("Uid:"):
                uid = line.split()[1]

        if cmdline:
            command = cmdline.replace("\x00", " ").strip()
        else:
            command = name

        processes.append((int(pid), uid, name, command))

The psutil version is obviously shorter but it hides everything behind the library. Reading status and cmdline by hand meant I had to actually learn the format of those files instead of just trusting a wrapper. Right now my version only pulls PID UID name and command out of status and cmdline since that was enough for a security audit but memory and CPU fields live in the same status file so adding them later is just a few more lines in that same for loop and not a rewrite.

Replacing Filelock and Watchdog in Code

Here is the chunk from my script showing chunk-based SHA-256 calculation and JSON writes:

import hashlib
import json
import os

def calculate_hash(filepath):
    """Calculates SHA-256 in 4096-byte binary chunks with pure hashlib"""
    sha256 = hashlib.sha256()
    try:
        with open(filepath, "rb") as f:
            while chunk := f.read(4096):
                sha256.update(chunk)
        return sha256.hexdigest()
    except (PermissionError, FileNotFoundError):
        return None

def save_hashes_atomically(data, target="hashes.json"):
    temp_file = f"{target}.tmp"
    with open(temp_file, "w") as f:
        json.dump(data, f, indent=2)
    os.replace(temp_file, target)

5. The 13 Security Commands Built In

Here is what each flag in the main script actually executes when run against a live system:

• -f, --file_integrity: Creates or updates hashes.json storing SHA-256 hashes file sizes UID GID and mtime for critical files like /etc/passwd and /etc/group.
• --check: Verifies current file hashes against the database and throws an exit code error if any file has been modified.
• --list: Prints all files currently tracked in the integrity database.
• --remove: Removes a specific file from tracking in hashes.json.
• --users: Searches for any non-root user that has UID 0 which is a major red flag for privilege escalation.
• --permissions: Scans for world-writable files with 777 permissions.
• --suid: Detects files with SUID and SGID bits active to prevent privilege abuse.
• --processes: Iterates /proc reading status and cmdline for every running process and prints PID UID name and command in a table.
• --network: Reads /proc/net/tcp and udp to list currently listening network ports.
• --services: Lists active system services via systemctl through subprocess.
• --logs: Searches through authentication log paths to surface failed login attempts.
• --system: Displays load averages total and free memory disk space and CPU architecture.
• --audit: Runs every check in sequence and outputs a full security assessment report.

6. Other Projects & Work

Apart from this zero-dependency hackathon tool here are some of my other open-source projects built for Linux environments and Android security:

• Linux-Server-Perfomance-stats-script: A lightweight Linux server monitoring script that captures crucial performances like CPU load averages memory usage swap usage and disk I/O stats without requiring heavy enterprise agents.
• Ad-Nuke: An Android tool and utility script focused on aggressive ad-blocking privacy controls by changing the /etc/hosts file(same file in linux environments) and redirecting the ad-blocking domains to localhost.
• Linux-file-integrity-checker: A dedicated Linux file integrity monitoring utility that tracks file modifications hashes and system changes to detect unauthorized tampering on servers.

You can check out the rest of my repos directly on my GitHub: github.com/Bhavishyaa12