dependency-scanner

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed, --min-age cooling-off gate, exit 4 when a scan is incomplete. SLSA L3, Sigstore-signed feed.

Scan Python dependencies for exploited CVEs and abandoned packages that handle untrusted input, ranked by CISA KEV and EPSS. Runs in CI and as a Claude Code hook.

🛡️ Blazing fast Supply Chain Security tool written in Rust. Features ephemeral sandboxing, hybrid analysis (CVE + Heuristics), and entropy-based malware detection.

Real-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.

A visual builder for AI workflows with security designed in: SSRF-guarded requests, rate limiting and encrypted BYOK keys. Includes an OSV.dev dependency scanner whose AI report can't change its findings. MIT licensed.

Educational dependency scanner built in pure Go—parse go.mod and go.sum, inspect direct and indirect modules, query OSV for vulnerabilities, and summarize licenses.

Supply-chain scanner. Flags malicious install code, typosquats, and shady provenance across your dependencies and your OS packages. Repo-reputation scoring, known-CVE intel, no telemetry.

Deterministic, reachability-aware software composition analysis (SCA) engine — lockfile-first resolution, function- & cross-package reachability, patch-diff symbol mining, EPSS/KEV, SARIF + OpenVEX. Zero runtime dependencies.

[OLD VERSION] Ultimate enterprise‑grade, AI & WASM‑powered Express security framework.

Scan Go modules for dependency updates, vulnerabilities, and upgrade risks. Explore results in an interactive, offline HTML report.

Paste your manifest. Get back the fixed files. Free browser-based dependency security fixer — npm, PyPI, Ruby, PHP. No login. No CLI.

A local-first application and supply-chain security engine spanning dependency security, install-time enforcement, host inventory, secrets, license compliance, SAST/malware analysis, cloud posture, and CI/CD gating.

Free dependency vulnerability scanner — scans full transitive tree for CVEs. Supports npm, PyPI, Maven. No signup.

Open-source local dependency and vulnerability scanner for Java (Maven/Gradle) and JavaScript (npm) projects.

Experimental local CLI for OSV advisory matches plus heuristic supply-chain evidence. Covers 10 ecosystems for OSV, with bounded npm/PyPI file sampling, npm registry metadata, a public-npm install assessment, OSV-cross-checked npm upgrade candidates, JSON/SARIF, and zero external runtime npm dependencies.

Supply-chain security and dependency analysis tool for the npm ecosystem

CEBS (C++ Ergonomic Build System) — A zero-config, blazingly fast, multi-threaded C++23 build system treating modules as first-class citizens. pretty fast too

Scan projects for CVEs in AI-generated dependencies. Zero API calls. Works offline.

Shell script to detect TanStack npm supply chain attack indicators (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx)