chainguard-dev/malcontent

Packj stops ⚡ Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

🔍🔍 Malware scanner for cloud-native, as part of CI/CD and at Runtime 🔍🔍

Protect against malicious open source packages 🤖

poutine, a supply chain vulnerability scanner for build pipelines

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

Read-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software supply-chain compromises.

🐍 🔎 GuardDog is a CLI tool to Identify malicious PyPI and npm packages

Open Source Package Analysis