JavaScript implementation of The Update Framework (TUF)
-
Updated
Aug 31, 2026 - TypeScript
#
package-security
Here are 40 public repositories matching this topic...
Verify PyPI package attestations and improve Python supply-chain security
python package pypi verification attestations supply-chain-security sigstore secuirity package-security
-
Updated
Sep 10, 2026 - Python
CLI client (and Golang module) for deps.dev API. Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.
go npm security maven nuget pypi supply-chain cargo hacktoberfest dependency-management blue-team supply-chain-management defensive-security golang-module go-module sbom dependency-scanning dependency-security sbom-generator package-security
-
Updated
Sep 7, 2026 - Go
Review the artifact before you publish it: diffs the built npm/PyPI package against the last published version and pins risk signals to the changed lines
-
Updated
Sep 10, 2026 - TypeScript
Demo repository showcasing how to use reusable workflows to build artifact attestations
-
Updated
Sep 7, 2026 - Python
Open-source server that refuses vulnerable package installs. The backend the refuse CLI shim calls.
npm security mcp pypi self-hosted cve hono devsecops vulnerability-scanner cloudflare-workers sbom apache-2 supply-chain-security package-security ai-coding-agents
-
Updated
Sep 7, 2026 - TypeScript
Autonomous “Shai-Hulud” engine that ingests malicious NPM package advisories from OSV, tracks versions and metadata, and maintains a continuously updated threat intelligence database.
nodejs npm security automation infosec osv security-tools devsecops threat-intelligence malware-detection github-actions open-source-security supply-chain-security package-security npm-security shai-hulud shai-hulud-detector shai-hulud2-detector malicious-packages-db
-
Updated
Sep 9, 2026 - JavaScript
Download, verify, and stage Microsoft Store packages without the Store app. Built for LTSC, recovery, offline deployment, and RMM workflows.
python windows open-source enterprise package-manager deployment powershell sysadmin windows-10 appx intune rmm msix offline-installer ltsc windows-11 microsoft-store windows-repair customtkinter package-security
-
Updated
Sep 7, 2026 - Python
Caught you. — Runtime network surveillance for PyPI and npm packages.
golang npm sandbox pypi syscalls ebpf security-tools runtime-analysis supply-chain-security package-security
-
Updated
Sep 9, 2026 - Go
DeepSeek Harness plugin that checks npm packages before install — 22 supply-chain rules, deep tarball scans, CI gates, local-first.
npm security ai sqlite scanner static-analysis supply-chain dsh security-scanner malware-detection dependency-security tool-plugin llm package-security deepseek agent-tools npm-security deepseek-harness dsh-plugin
-
Updated
Aug 29, 2026 - TypeScript
Local-first npm supply-chain security scanner: static + optional LLM analysis, CLI/CI gates, desktop app, and AI-agent skills.
desktop-app cli npm security typescript sqlite scanner static-analysis supply-chain developer-tools software-supply-chain devsecops ai-agents neutralinojs dependency-security llm package-security npm-security
-
Updated
Sep 3, 2026 - TypeScript
oh supply chain my supply chain — a multi-ecosystem package malware scanner for PyPI, npm, crates.io, and Go. Static analysis plus a sandbox detonation engine, with pluggable detection content (open-core; AGPL engine, Apache-2.0 signatures).
npm sandbox static-analysis pypi crates-io software-supply-chain yara typosquatting security-tools devsecops threat-intelligence malware-detection malware-scanner go-modules supply-chain-security dependency-confusion package-security
-
Updated
Jun 11, 2026 - Python
Secure your dependencies before they land in production. secure-packages audits package source, reviews new-version diffs, and blocks risky updates in CI/CD, starting with PyPI.
rust pypi software-supply-chain python-packages devsecops dependency-security supply-chain-security package-security
-
Updated
Mar 30, 2026 - Rust
100-eyed guardian — static install-time scanner for npm supply-chain attacks. Rust CLI.
rust cli npm security static-analysis malware-detection supply-chain-security javascript-security package-security install-time-scanner
-
Updated
Sep 10, 2026 - Rust
Supply-chain security scanner for npm packages. Detect malicious code, typosquatting, and compromised dependencies before you install them.
rust cli npm security tree-sitter static-analysis supply-chain developer-tools cve typosquatting sarif devsecops vulnerability-scanner malware-detection npm-audit package-security npm-security
-
Updated
Jun 29, 2026 - Rust
A beautiful, zero-config visual CVE dashboard for npm & Python. One command: npx osv-ui. 100% Local & Secure.
security-audit monorepo cybersecurity cve cve-scanning osv vulnerability-scanner cve-search npm-audit package-security osv-scanner audit-source osv-dashboard osv-scanner-dashboard osv-scanner-ui cve-scanner-ui cve-scanner-dashboard osv-mcp cve-mcp
-
Updated
Aug 31, 2026 - HTML
Security layer for AI agents: real-time interception of pip/npm/cargo/gem/go installs via Hermes & OpenClaw plugins, Claude Code/Codex hooks, MCP, shell guard, PATH shim, execve, and index proxy. Checks CVEs (OSV/NVD/GitHub), typosquats, malware, licenses, provenance, trust, lockfile hashes. Offline mirror, hash-chained audit, SBOM/SARIF.
python npm mcp pip cve typosquatting sarif security-tools ai-agents vulnerability-scanning sbom supply-chain-security package-security llm-security mcp-server agent-security claude-code
-
Updated
Jul 6, 2026 - Python
VirusTotal for AI packages. ai-trust check <pkg> returns a 0-100 trust score from the OpenA2A Registry trust graph, covering security scans, advisories, and dependency risk. For MCP servers, A2A agents, skills, and LLM packages.
registry tool ai-agents ai-security supply-chain-security trust-score package-security llm-security mcp-security
-
Updated
Sep 10, 2026 - TypeScript
World-class security standard for npm packages. Automated threat detection, supply chain analysis, and 0-100 security scores. Because in 2025, we can do better than the Wild West
-
Updated
Nov 29, 2025 - JavaScript
Add this topic to your repo
To associate your repository with the package-security topic, visit your repo's landing page and select "manage topics."