dependency-security

Here are 19 public repositories matching this topic...

edoardottt / depsdev

CLI client (and Golang module) for deps.dev API. Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.

go npm security maven nuget pypi supply-chain cargo hacktoberfest dependency-management blue-team supply-chain-management defensive-security golang-module go-module sbom dependency-scanning dependency-security sbom-generator package-security

Updated
Go

koalalab-inc / pinny

Star

Pin your 3rd Party Github Actions and Docker Images dependencies.

cicd security-tools docker-security github-actions dependency-security supply-chain-security

Updated
Go

Sentinel Package Manager blocks compromised packages BEFORE installation, preventing malicious code execution. Features: Pre-install blocking, command interception (npm/yarn/pnpm/bun), 795+ blacklist (Shai-Hulud), real-time checks (OSV/GitHub/Snyk), zero dependencies, auto-updates. Counters supply chain attacks.

npm security package-manager blacklist yarn pnpm security-tools bun vulnerability-scanner malware-detection zero-dependencies dependency-security supply-chain-security npm-security shai-hulud supply-chain-attack pre-install-validation package-validation npm-worm compromised-packages

Updated
JavaScript

vimox-shah-genea / vulnerability-agent

Star

🛡️ AI-powered vulnerability scanner that automatically detects, analyzes, and fixes security issues in npm packages with intelligent code transformations. Supports GitHub Actions, CLI, Docker, and VS Code integration with Microsoft Teams notifications.

security devops automation code-transformation security-automation vulnerability-scanner npm-audit dependency-security ai-powered ai-code-generation automated-fixes

Updated
TypeScript

kunaldeo / secure-packages

Star

Secure your dependencies before they land in production. secure-packages audits package source, reviews new-version diffs, and blocks risky updates in CI/CD, starting with PyPI.

rust pypi software-supply-chain python-packages devsecops dependency-security supply-chain-security package-security

Updated
Rust

matte1782 / phantom_guard

Star

👻 Stop installing packages that don't exist. When AI hallucinates names like "flask-gpt-helper", attackers register them as malware. Phantom Guard detects slopsquatting attacks across PyPI, npm & crates.io before you install.

python cli npm security devops pypi pip cybersecurity typosquatting ai-safety devsecops malware-detection dependency-security supply-chain-security package-validation slopsquatting

Updated
Python

Pirikara / chaingate

Star

Security wrapper for package managers using a local MITM proxy and the OSSF malicious-packages DB to block malware before install.

dependency-security supply-chain-security

Updated
Go

1minds3t / urllib3-lts

Sponsor

Star

Long-Term Support (LTS) security fork of urllib3 with backported CVE fixes for Python 3.7 and 3.8.

python security security-audit dos http-client cybersecurity lts cve eol ssrf backport security-tools python37 urllib3 python38 dependency-security python39 long-term-support

Updated
Python

Beneking102 / bene-version-checker

Star

Open-source CVE lookup tool for software packages. Check vulnerabilities, CVSS scores, version age, and latest releases across 8 ecosystems using OSV.dev.

security package-manager typescript nextjs cve cve-scanning osv software-security vulnerability-scanners cvss security-tools devsecops dependency-security open-source-security supply-chain-security dependency-audit osv-dev package-security

Updated
TypeScript

ctrlzmydecisions / originfence

Star

GitHub-native dependency trust gate for pull requests

npm typescript pypi supply-chain provenance osv security-tools devsecops github-action dependency-security supply-chain-security sigstore software-supply-chain-security

Updated
JavaScript

oopsalldev / npm-supply-chain-scanner

Star

Multi-ecosystem supply chain attack scanner. 25+ threats across npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet. Claude Code skill + CLI + GitHub Action.

pypi cargo security-scanner github-action dependency-security supply-chain-security claude-code npm-security claude-code-skill

Updated
Shell

farandclose / dependency-diagnostic

Star

Run a quick security check on any Node or Python project to see if your dependencies are configured safely.

npm pypi software-supply-chain security-tools dependency-security supply-chain-security

Updated

sneko / devm

Star

Sandbox your code to protect against dependency attacks, and let your AI agent work on its own

macos linux bash cli security vm ai sandbox opencode developer-tools safe isolation lima dev-environment codex claude dependency-security

Updated
Shell

thebasedcapital / pfw

Star

Package Firewall — self-hosted supply chain security for macOS. Intercepts npm/pip/cargo/yarn in ALL shells including AI agents. 4 vuln sources (OSV + GHSA + deps.dev + CISA KEV). Zero telemetry.

macos security package-manager firewall self-hosted cve osv sca devsecops vulnerability-scanner malware-detection lulu dependency-security supply-chain-security ai-agent-security npm-security zero-telemetry supply-chain-attack pip-security cargo-security

Updated
TypeScript

zebbern / depfence

Sponsor

Star

Detect dependency confusion attack vectors in Node.js projects

dependency-injection dependency-analysis dependencies dependency dependencies-collector dependency-security dependency-scanner dependency-scans

Updated
TypeScript

GandalFran / dephook

Star

A lightweight CLI focused on security & visibility of dependencies, inspecting Node.js projects for install/prepare hooks and binaries. Find out what dependencies are running scripts during install, why they are present, and what binaries they expose.

dependency-security supply-chain-security package-audit lockfile-analysis dependency-visibility transitive-dependency-analysis install-script-detection dependency-traceability

Updated
TypeScript

AlaBouali / ubel

Star

Ubel is a fast, cross‑ecosystem security engine that resolves dependencies, generates PURLs, scans them through OSV.dev, and enforces security policies during installation to prevent supply-chain attacks. It works with: PyPI (via ubel-pip), npm (via ubel-npm),and Linux distributions (Ubuntu-based, Debian-based, RHEL, AlmaLinux).