{"repo":"ossillate-inc/packj","free":true,"listed":false,"github":"https://github.com/ossillate-inc/packj","clone":"git clone https://github.com/ossillate-inc/packj.git","description":"Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies (\"weak links\") in your software supply-chain","language":"Python","stars":691,"topics":["malware","npm","pypi","python","security","security-audit","security-tools","vulnerability","rubygems","supply-chain-security"],"license":"AGPL-3.0","category":"security-tools","readme_excerpt":"  Packj flags malicious/risky open-source packages Packj (pronounced package) is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other \"risky\" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. It can be easily customized to minimize noise. Packj started as a PhD research project and is currently being developed under various govt grants. Note Self-hosted Packj webserver and several integrations coming later this month :punch: Watch this repo to stay up to date. Contents # Get started - available as Docker image, GitHub Action, and packages Functionality - deep static/dynamic code analysis and sandboxing Supported ecosystems - NPM, PyPI, Rubygems, PHP, Rust Our story - started as a PhD research project and is backed by govt grants Why Packj - existing CVE scanners ASSUME code is BENIGN and not analyze its behavior Customization - turn off alerts as per your threat model to reduce noise Malware found - reported over 70 malicious PyPI and RubyGems packages Talks and videos - presentations from PyCon, OpenSourceSummit, BlackHAT Project roadmap - view or suggest new features; join our discord channel Team and collaboration - lead by Cybersecurity researchers from academia/industry FAQ - supported package managers, commonly asked questions on techniques, and more Get started # We support multiple deployment models: 1. GitHub runner Use Packj to audit dependencies ","default_branch":null,"files":null,"tree":[],"storefront":"/r/ossillate-inc","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/ossillate-inc/packj/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}