10078 matches found
depsguard
depsguard | | | | / |/ \ ' / |/ | | | |/ | '/ | | | | / | \ \ | | || | | | | | | | ,|| ./|/, |,|,|| ,| || |/ Guard your dependencies against supply chain attacks. Single static binary, zero Rust crate dependencies. By arnica Table of contents Overview Install Usage What gets checked Config...
depx
depx Malicious package & supply-chain intelligence Features • Installation • Usage • Running depx • JSON • Join Discord depx is a fast, passive supply-chain intelligence CLI. It tells you whether a package is known malicious hijacked publishes, credential stealers, install-script backdoors by...
gitlab-profile
TEST STATUS : ↳ core-orchestrator tester ↳ documentation tester CREATION DATE: 2025-10-24 09:50 PM ↳ Alberto Marangelo - @theGlitched !WARNING ⚠️ This project is in beta! 🎉 yeah! We're happy to announce that the beta version will soon be complete! From the version 0.153 is currently started all...
isms-builder
ISMS Builder Self-hosted Information Security Management System — open source, no cloud required 📖 Wiki — Docker-Image-Nutzung & Umgebungsvariablen, Architektur & Module, FAQ, Mitwirken DE/EN ⚠️ Security Warning: Fake repositories and copies distributing malware ISMS Builder has no packaged...
npm-incident-response
npm-incident-response English | Português Standalone scanner for the keyv/cacheable supply-chain incident "Shai-Hulud: Here We Go Again", Aug 4 2026 — 440+ npm packages compromised by a self-propagating worm that steals cloud/CI credentials and plants persistence with a dead-man's switch. Detects...
smart-tree
🌳 Smart Tree - The Smart Treehouse: Cyber-Botanical Dashboard & Agent-Agnostic Hooks! 🌐 Smart Tree is a blazingly fast, AI-friendly directory visualization tool that's 10-24x faster than traditional tree. Now with Security Scanner for supply chain attack detection, Aye Consciousness preservation,...
proxy
git-pkgs proxy A caching proxy for package registries. Speeds up package downloads by caching artifacts locally, reducing bandwidth usage and improving reliability. Version Cooldown Most supply chain attacks rely on speed: a malicious version gets published and consumed by automated pipelines...
bubblewrap
Bubblewrap Many container runtime tools like systemd-nspawn, docker, etc. focus on providing infrastructure for system administrators and orchestration tools e.g. Kubernetes to run containers. These tools are not suitable to give to unprivileged users, because it is trivial to turn such access in...
smokedmeat
SmokedMeat CI/CD Red Team Framework Like Metasploit, but for CI/CD pipelines. From the makers of thepoutine Build Pipeline SAST scanner at BoostSecurity Labs. Warning: This tool is for authorized security testing only. SmokedMeat exists because CI/CD pipeline threats are deeply underestimated...
CVE-2024-3094
CVE-2024-3094 I've moved my notes in Obsidian to a separate vault and this GitHub repository to be able to share it. The start page is CVE-2024-3094 xz supply chain. Installation Clone the repo with git. git clone https://github.com/reuteras/CVE-2024-3094.git Then open the checked out folder as a...
supply-chain-monitor
Supply Chain Monitor Automated monitoring of the top PyPI and npm packages for supply chain compromise. Polls both registries for new releases, diffs each release against its predecessor, and uses an LLM via Cursor Agent CLI to classify diffs as benign or malicious. Malicious findings trigger a...
EXPLOIT-CVE-2026-33634
CVE-2026-33634 — LiteLLM supply chain + SSRF in apibase PoC / Lab ⚠️ Deliberately vulnerable lab, for educational and authorized use only. Run it only on your machine, against the containers in this repository. Read SECURITY-NOTES.md before starting. 🚫 NEVER run this lab on a cloud VM or a shared...
CVE-2024-3094-checker
CVE-2024-3094 checker xz Utils versions 5.6.0 and 5.6.1 appear to be compromised. XZ Utils is data compression software and may be present in Linux distributions. The malicious code may allow unauthorized access to affected systems. Sources: https://vulners.com/cve/CVE-2024-3094...
packj
Packj flags malicious/risky open-source packages Packj pronounced package is a tool to help to mitigate software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and...
guac
GUAC: Graph for Understanding Artifact Composition Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide. GUAC is an OpenSSF incubating project under the Supply Chain Integrity WG. Graph for Understanding Artifact Composition GUAC...
tfsec
📣 tfsec to Trivy Migration As part of our goal to provide a comprehensive open source security solution for all, we have been consolidating all of our scanning-related efforts in one place, and that is Trivy. Over the past year, tfsec has laid the foundations to Trivy's IaC & misconfigurations...
DEFCON-CICD-pipelines-workshop
CI/CD : The new Eldorado ? Abstract CI/CD pipelines are increasingly becoming part of the standard infrastructure within dev teams, with the rise of new approaches such as Infrastructure as Code, the sensitivity level of such pipelines is escalating quickly. In case of compromise, it is not just...
pmg
Package Manager Guard PMG Block malicious packages before they install. Why PMG? Developers and AI coding agents install packages every day. Each npm install or pip install executes thousands of lines of code that nobody reviews. Recent compromises in popular ecosystems: Mini Shai-Hulud - 300+...
CVE-2010-2075
CVE-2010-2075 — UnrealIRCd 3.2.8.1 Backdoor Exploit Overview UnrealIRCd is an open-source IRC Internet Relay Chat server — a protocol that allows users to communicate in real-time over a network, similar to early chat platforms. In 2009–2010, it was discovered that UnrealIRCd 3.2.8.1 distributed...