IBM/audit-ci

Harden your package manager configs against supply chain attacks.

Protect against malicious open source packages 🤖

OWASP dep-scan is a next-generation security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies. Both local repositories and container images are supported as the input, and the tool is ideal for integration.

Fail CI when dependencies in your lockfile lose npm provenance or trusted publisher status

Command-line interface for socket.dev security analysis

A simple project to detect the Shai-Hulud npm supply chain attack

NPM Package

Lint an npm or yarn lockfile to analyze and detect security issues

Plumber detects CI/CD security issues in your GitHub workflows and gives you a score