@thor or @theopolis I noticed that the implementation of python_packages table only seems to be searching 2.7 packages and that it seems to be doing so via a list of paths to search for packages: https://github.com/facebook/osquery/blob/3de45f5abb3148f7b63b50e6db96f9ea46d1ecea/osquery/tables/system/python_packages.cpp#L32