packj - malicious dependency scanner
Static and dynamic analysis tool that flags malicious or vulnerable open-source packages across npm, PyPI, RubyGems, and more. Aimed at SolarWinds- and PyTorch-style supply-chain attacks.
All entriesGitHubTool GitHubTool GitHubTool
Tag
#supply-chain
3 entries tagged with #supply-chain.
realstars - detect fake GitHub stars
Open-source rebuild of CMU's Star Scout that flags suspicious stargazer patterns on a repo. Useful when vetting trending repos before adding dependencies.
AgentShield - security scanner for AI agents
CLI, GitHub Action, and GitHub App that scan agent configs, MCP servers, and tool permissions for vulnerabilities. Detects skill poisoning and prompt-injection vectors.