npm · crates.io
endojs/endo
Endo is a distributed secure JavaScript sandbox, based on SES
Apache-2.0Sep 15, 2026 · metrics 2.10.0
All tags
Catalogue tag
#supply-chain
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
64 records
Go
sigstore/rekor
Software Supply Chain Transparency Log
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Go
sigstore/sigstore
Common go library shared across sigstore services and clients
Apache-2.0Oct 21, 2026 · metrics 2.10.0
PyPI
sigstore/sigstore-python
A Sigstore client written in Python
Custom licenseSep 17, 2026 · metrics 2.10.0
Go · npm
mindersec/minder
Software Supply Chain Security Platform
Apache-2.0Sep 12, 2026 · metrics 2.10.0
Go
sigstore/rekor-tiles
Signature Transparency Log designed for ease of use, low cost, and minimal maintenance
Apache-2.0Sep 15, 2026 · metrics 2.10.0
Go
guacsec/guac
GUAC aggregates software security metadata into a high fidelity graph database.
Apache-2.0Oct 19, 2026 · metrics 2.10.0
PyPI
pypa/pip-audit
Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
Apache-2.0Aug 27, 2026 · metrics 2.10.0
PyPI · npm
koda-ai-studio/agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Apache-2.0Oct 16, 2026 · metrics 2.10.0
PyPI · npm
msaad00/agent-bom
Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.
Apache-2.0Sep 8, 2026 · metrics 2.10.0
Go
theupdateframework/go-tuf
Go implementation of The Update Framework (TUF)
Apache-2.0Sep 15, 2026 · metrics 2.10.0
PyPI
sigstore/gh-action-sigstore-python
A GitHub Action for sigstore-python
Apache-2.0Oct 8, 2026 · metrics 2.10.0
npm
sigstore/sigstore-js
Code-signing for npm packages
Apache-2.0Oct 21, 2026 · metrics 2.10.0
npm · Maven · NuGet +1
cdxgen/cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
carabiner-dev/ampel
🔴🟡🟢 The Amazing Multipurpose Policy Engine (and L)
Apache-2.0Sep 12, 2026 · metrics 2.10.0
Go · npm
seebom-labs/BOMHort
About standalone, Kubernetes-native Software Bill of Materials (SBOM) visualization and governance platform
Apache-2.0Sep 14, 2026 · metrics 2.10.0
npm
asamassekou10/ship-safe
CLI security scanner built for the agentic era. Detects CI/CD misconfigs, agent permission risks, MCP tool injection, hardcoded secrets, and DMCA-flagged AI dependencies.
MITSep 6, 2026 · metrics 2.10.0
crates.io
rust-secure-code/cargo-auditable
Make production Rust binaries auditable
Apache-2.0Oct 21, 2026 · metrics 2.10.0
npm
blamejs/blamejs
The Node framework that owns its stack.
Apache-2.0Oct 20, 2026 · metrics 2.10.0
npm · PyPI
DNSZLSK/muad-dib
Real-time npm/PyPI supply-chain threat detection. Behavioral chain analysis, AST scanning, IOC feeds, and compound scoring engine.
AGPL-3.0Oct 20, 2026 · metrics 2.10.0
PyPI · npm
PrismorSec/prismor
Self-hosted runtime control plane for AI agents. Observe or HITL approve or Block rogue tool calls before it executes: secret leaks, prompt injection, supply chain etc in a local dashboard. Agent agnostic (Claude, codex, langchain etc.)
Apache-2.0Sep 11, 2026 · metrics 2.10.0
crates.io
sebastienrousseau/metadata-gen
Typed, audited, zero-allocation-bound frontmatter parser for Rust — YAML/TOML/JSON extraction, SEO meta tag emission, supply-chain attested (cargo-vet, SBOM, RUSTSEC). WASI-bound roadmap.
Apache-2.0Sep 18, 2026 · metrics 2.10.0
PyPI
Ndevu12/stayAwakeBot
A bot for helping you to stay secure! Services stay a wake
AGPL-3.0Sep 15, 2026 · metrics 2.10.0
PyPI
pezhik/skilltotal
Scan AI components (MCP servers, agent skills, npm/PyPI packages) for malware & risky capabilities. Local, deterministic, evidence-anchored. Free & OSS.
Apache-2.0Oct 9, 2026 · metrics 2.10.0
npm
blamejs/pki
Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
npm
mayurrawte/searoute-ts
Shortest sea route between any two points on Earth. TypeScript library with the 2025 Eurostat maritime network, canal/strait restrictions (Suez, Panama, Bab-el-Mandeb…), vessel-draft gating, K-shortest alternatives, multi-leg waypoints, and ETA from speed.
MITSep 20, 2026 · metrics 2.10.0
PyPI
shcherbak-ai/tethered
tethered - Runtime network egress control for Python. One function call to restrict which hosts your code can connect to.
MITOct 14, 2026 · metrics 2.10.0
npm
this-is-securl/securl
SecURL - passive external security posture scanner. Free hosted scanner, open-source engine, CI integration
MITSep 8, 2026 · metrics 2.10.0
npm
adamsjack711-ux/pkgxray
Pre-install security for AI agents, npm packages, and MCP servers. Zero-dep local static analysis; normal scans never execute package code.
MITSep 10, 2026 · metrics 2.10.0
crates.io
jdx/packslip
A signed release manifest for vendor binaries
MITSep 18, 2026 · metrics 2.10.0