depx

depx Malicious package & supply-chain intelligence Features • Installation • Usage • Running depx • JSON • Join Discord depx is a fast, passive supply-chain intelligence CLI. It tells you whether a package is known malicious hijacked publishes, credential stealers, install-script backdoors by...

bomber

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

osv-scanner

Use OSV-Scanner to find existing vulnerabilities affecting your project's dependencies. OSV-Scanner provides an officially supported frontend to the OSV database and CLI interface to OSV-Scalibr that connects a project’s list of dependencies with the vulnerabilities that affect them. OSV-Scanner...

deptrust

deptrust root@kitploit: / / / / / / / / / / / / / / / / / / / // / / // / / // / ,// ./// ,/// // deptrust es una CLI que comprueba las versiones de paquetes en busca de vulnerabilidades conocidas en npm, PyPI, crates.io, módulos de Go, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods,...

pyscan

Pyscan Pyscan is a highly concurrent vulnerability scanner written in Rust. It automatically traverses your Python project, extracts dependencies across various packaging formats, and cross-references them against the Open Source Vulnerabilities OSV database in a single asynchronous batch request...

CTWall

CTWall - ChainThreatWall Lanzamiento de GitHub --- A medida que más equipos se trasladan a entornos de desarrollo virtualizados para reducir el riesgo de la cadena de suministro de software, un desafío persiste: las dependencias maliciosas aún pueden colarse y llegar a producción. La plataforma...

google-poc

To reporoduce the CVE-2025-13425 just follow the steps below: Step 1: Clone the fresh osv-scalibr source code: root@kitploit: $ git clone https://github.com/google/osv-scalibr Step 2: Remove the code mentioned in fix commit...

cve-lite-on-pi

cve-lite-on-pi A short write-up of running CVE Lite CLI against the pi monorepo, and what it found. Background This experiment was prompted by the article "OWASP CVE Lite CLI – New Tool to Scan for Vulnerabilities in Your Projects" CyberSecurityNews. What is CVE Lite CLI? CVE Lite CLI is a...

GO-2026-4569 vulnerabilities

Vulnerabilities for packages: opencost-fips, datadog-agent, opencost, osv-scanner, flux-operator-fips, gptscript, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, jaeger, datadog-agent-fips, flux-operator, github-mcp-server, ferretdb, jaeger-fips...

GO-2026-4770 vulnerabilities

Vulnerabilities for packages: opencost-fips, glab, datadog-agent, livekit-cli, opencost, osv-scanner, flux-operator-fips, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, jaeger, datadog-agent-fips, flux-operator, ferretdb, jaeger-fips...

GO-2026-4858 vulnerabilities

Vulnerabilities for packages: skaffold, zot, podman-fips, skaffold-fips, kubescape, trivy-fips, kaniko, conftest-fips, cloudbeat-fips, kubescape-server-fips, podman, trivy-operator, docker-compose-fips, livekit-cli, osv-scanner, docker-cli-buildx, docker-cli-buildx-fips, trivy, cloudbeat,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: skaffold, amazon-ssm-agent, kubevela-fips, k9s-fips, skaffold-fips, src-fingerprint, cerbos, k9s, xeol-fips, zarf, pulumi-kubernetes-operator, gitea-fips, kubescape-server-fips, gitaly-fips, livekit-cli, witness, xeol, grype, cloudbeat, gomplate-fips, syft,...

GO-2025-4098 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent-fips, skaffold, amazon-k8s-cni-fips, spegel-fips, neuvector-fips, kubescape-operator, nerdctl, cluster-autoscaler, k9s-fips, skaffold-fips, xeol-fips, k9s, zarf, volcano-fips, rancher, azure-container-networking, xeol, eks-distro, grype,...

GO-2026-4770 vulnerabilities

Vulnerabilities for packages: datadog-agent, glab, jaeger, opencost, osv-scanner, ferretdb...

GO-2026-4569 vulnerabilities

Vulnerabilities for packages: datadog-agent, gptscript, jaeger, opencost, github-mcp-server, osv-scanner, ferretdb...

GO-2026-4773 vulnerabilities

Vulnerabilities for packages: datadog-agent, glab, jaeger, opencost, osv-scanner, ferretdb...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: grpc-health-probe, guac, zot, sigstore-scaffolding, zarf, terraform-docs, certificate-transparency, conftest, falcosidekick, grafana-mimir, spire-server, vcluster, ferretdb, kube-rbac-proxy, kwok, cilium-cli, terraform-provider-google, k3s, restic, sops, spegel, kots...

GO-2025-4175 vulnerabilities

Vulnerabilities for packages: gitness, go-discover, gogatekeeper, opensearch-k8s-operator, helm-operator, kubernetes-dashboard-auth, secrets-store-csi-driver-provider-azure, opa-envoy, slsa-verifier, task, sonobuoy, secrets-store-csi-driver, nats-server, runc, sftpgo-plugin-kms,...

GO-2026-4859 vulnerabilities

Vulnerabilities for packages: trivy-operator, scorecard, guac, zot, skaffold, buildah, conftest, kubescape, trivy, podman, docker-compose, kaniko, osv-scanner, docker-cli-buildx...

GO-2025-3528 vulnerabilities

Vulnerabilities for packages: zot, zarf, k8ssandra-client, wolfictl, helm-operator, rancher-fleet, helm, opa-envoy, buildkitd, cilium-cli, docker, envoy-gateway, k3s, spegel, fuse-overlayfs-snapshotter, nerdctl, kots, helm-push, linkerd2, syft, skaffold, osv-scanner, ctop, flux-source-controller,...