software-composition-analysis

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.

🔎 ScanCode detects licenses, copyrights, package manifests & dependencies and more by scanning code ... to discover and inventory open source and third-party packages used in your code.

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.

An open source tool focused on software supply chain security. 墨菲安全专注于软件供应链安全，具备专业的软件成分分析（SCA）、漏洞检测、专业漏洞库。

SBT Plugin for OWASP DependencyCheck. Monitor your dependencies and report if there are any publicly known vulnerabilities (e.g. CVEs). 🌈

Scans your project to determine what components you use

A simple Java command-line utility to mirror the CVE JSON data from NIST.

A compilation of resources in the software supply chain security domain, with emphasis on open source

A curated list of Software Component Analysis (SCA) books, courses - free and paid, videos, tools, and tutorials.

ScanCode.io is a server to script and automate software composition analysis pipelines with ScanPipe pipelines.

🔐 Shim to easily install OWASP dependency-check-cli into Python projects

A light-weight app to audit and inventory large codebases for open source license compliance.

Maven plugin that integrates with a Dependency Track server to submit dependency manifests and optionally fail execution when vulnerable dependencies are found.

OWASP Dependency Track API client for intergration into CI/CD pipeline

A simple Java command-line utility to mirror the entire contents of VulnDB.

A GitHub Action for using SecureStack to analyse a repository codebase for vulnerabilities in library dependencies (software composition analysis).

Creates CycloneDX Software Bill-of-Materials (SBOM) from Go projects. So you can use it with DependencyTrack to monitor security issues in 3rd party modules.

Sharing software supply chain security open source projects