package-security

Here are 19 public repositories matching this topic...

gensecaihq / Shai-Hulud-2.0-Detector

Detect npm packages compromised in the Shai-Hulud 2.0 supply chain attack (Nov 2025). Scans for 790+ malicious packages, suspicious scripts, TruffleHog activity, SHA1HULUD runners, and secrets exfiltration. GitHub Action with SARIF support.

nodejs npm security sarif devsecops vulnerability-scanner malware-detection credential-theft github-actions open-source-security supply-chain-security sarif-report package-security shai-hulud shai-hulud-detector shai-hulud-attack shai-hulud2-detector shai-hulud2 shai-hulud2-inspector sha1-hulud

Updated
TypeScript

theupdateframework / tuf-js

Star

JavaScript implementation of The Update Framework (TUF)

package-security

Updated
TypeScript

edoardottt / depsdev

Sponsor

Star

CLI client (and Golang module) for deps.dev API. Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.

go npm security maven nuget pypi supply-chain cargo hacktoberfest dependency-management blue-team supply-chain-management defensive-security golang-module go-module sbom dependency-scanning dependency-security sbom-generator package-security

Updated
Go

github / artifact-attestations-opa-provider

Star

OPA Gatekeeper provider for GitHub Artifact Attestations

package-security

Updated
Go

github / artifact-attestations-workflows

Star

Demo repository showcasing how to use reusable workflows to build artifact attestations

package-security

Updated
Python

triconinfotech / shai-hulud-malicious-packages

Star

Autonomous “Shai-Hulud” engine that ingests malicious NPM package advisories from OSV, tracks versions and metadata, and maintains a continuously updated threat intelligence database.

nodejs npm security automation infosec osv security-tools devsecops threat-intelligence malware-detection github-actions open-source-security supply-chain-security package-security npm-security shai-hulud shai-hulud-detector shai-hulud2-detector malicious-packages-db

Updated
JavaScript

01tek / npm-security-score

Star

World-class security standard for npm packages. Automated threat detection, supply chain analysis, and 0-100 security scores. Because in 2025, we can do better than the Wild West

npm security supply-chain ci-cd security-tools devsecops vulnerability-scanner package-security

Updated
JavaScript

kunaldeo / secure-packages

Star

Secure your dependencies before they land in production. secure-packages audits package source, reviews new-version diffs, and blocks risky updates in CI/CD, starting with PyPI.

rust pypi software-supply-chain python-packages devsecops dependency-security supply-chain-security package-security

Updated
Rust

👁 osv-ui

toan203 / osv-ui

Star

A beautiful, zero-config visual CVE dashboard for npm & Python. One command: npx osv-ui. 100% Local & Secure.

security-audit monorepo cybersecurity cve cve-scanning osv vulnerability-scanner cve-search npm-audit package-security osv-scanner audit-source osv-dashboard osv-scanner-dashboard osv-scanner-ui cve-scanner-ui cve-scanner-dashboard osv-mcp cve-mcp

Updated
HTML

Halfblood-Prince / trustcheck

Star

Verify PyPI package attestations and improve Python supply-chain security

python package pypi verification attestations supply-chain-security sigstore secuirity package-security

Updated
Python

z8run / aegis

Star

Supply-chain security scanner for npm packages. Detect malicious code, typosquatting, and compromised dependencies before you install them.

rust cli npm security tree-sitter static-analysis supply-chain developer-tools cve typosquatting sarif devsecops vulnerability-scanner malware-detection npm-audit package-security npm-security

Updated
Rust

RalianENG / kojuto

Star

Caught you. — Runtime network surveillance for PyPI and npm packages.

golang npm sandbox pypi syscalls ebpf security-tools runtime-analysis supply-chain-security package-security

Updated
Go

diegosantdev / publishcanary

Star

Scans the real npm publish tarball before release and blocks leaks like source maps, secrets, internal files, and suspicious oversized artifacts.

nodejs cli npm security tarball devtools npm-publish package-security secrets-scanning

Updated
JavaScript

Beneking102 / bene-version-checker

Star

Open-source CVE lookup tool for software packages. Check vulnerabilities, CVSS scores, version age, and latest releases across 8 ecosystems using OSV.dev.