#supply-chain-security (25 Repositories)
Ranked open-source repositories tagged with #supply-chain-security, scored by pull request acceptance likelihood and maintainer engagement velocity.
66.9%
57.1h
25 repositories tagged #supply-chain-security
safedep/pmg
PMG protects developers, AI agents from malicious open source packages using proxy, sandbox and SafeDep's threat intelligence feed.
chainloop-dev/chainloop
SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more
slsa-framework/slsa
Supply-chain Levels for Software Artifacts
konflux-ci/konflux-ci
Trusted builds made easy! A cloud-native software factory for building, testing, and releasing trusted software artifacts
guacsec/guac
GUAC aggregates software security metadata into a high fidelity graph database.
nolabs-ai/nono
agent runtime security - zero trust, zero setup, zero latency agent sandbox
openai/fence
A fence keeps things out, but also in. This project is still in early, and active development.
git-pkgs/proxy
A lightweight caching proxy for package registries.
cicd-sensor/cicd-sensor
Open-source eBPF runtime security sensor for GitHub Actions and GitLab CI/CD.
getnora-io/nora
Lightweight multi-format artifact registry. 15 formats: Docker, Maven, npm, PyPI, Cargo, Go, Raw, RubyGems, Terraform, Ansible Galaxy, NuGet, Pub, Conan, RPM, and Debian/APT. Single binary, zero dependencies, < 50 MB RAM idle.
step-security/dev-machine-guard
Scan your dev machine for AI agents, MCP servers, IDE extensions, and suspicious packages - in seconds.
kpcyrd/rebuilderd
Independent verification of binary packages - Reproducible Builds
ckotzbauer/sbom-operator
Catalogue all images of a Kubernetes cluster to multiple targets with Syft
sheeki03/tirith
Terminal security for developers and AI agents. Intercepts homograph URLs, pipe-to-shell, ANSI injection, obfuscated payloads, data exfiltration, and malicious AI skills/configs before they execute.
safedep/vet
Protect against malicious open source packages 🤖
NodeSecure/js-x-ray
JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.
step-security/secure-repo
Orchestrate GitHub Actions Security
projectdiscovery/depx
Malicious package & supply-chain intelligence
praetorian-inc/trajan
A multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations.
gensecaihq/Shai-Hulud-2.0-Detector
GitHub Action that detects the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain attacks. Scans dependencies, lockfiles and CI workflows against a daily-updated database of 1,200+ compromised packages, flags malicious install scripts, TruffleHog secret theft and SHA1HULUD runners. SARIF output for GitHub Code Scanning.
ossillate-inc/packj
Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain
perplexityai/bumblebee
Read-only developer endpoint scanner for on-disk package, extension, and developer-tool metadata, built to check exposure to known software supply-chain compromises.
docker/scout-cli
Docker Scout CLI
CycodeLabs/cimon-action
Runtime Security Solution for your CI/CD Pipeline
Legit-Labs/legitify
Detect and remediate misconfigurations and security risks across all your GitHub and GitLab assets