danielroe/provenance-action

Lint an npm or yarn lockfile to analyze and detect security issues

Harden your package manager configs against supply chain attacks.

Securing open-source package ecosystems by originating, validating, and augmenting build attestations.

Audit NPM, Yarn, PNPM, and Bun dependencies in continuous integration environments, preventing integration if vulnerabilities are found at or above a configurable threshold while ignoring allowlisted advisories

GitHub Action to publish to NPM

A simple project to detect the Shai-Hulud npm supply chain attack

A GitHub Action for detecting vulnerable dependencies and invalid licenses in your PRs

Protect against malicious open source packages 🤖

A tool for running Dependabot update jobs.