supply-chain-security — independent software & tools

9 independent supply-chain-security listings the big search engines bury.

• clauderabbit

  github · Free · by AIdhirajSingh

  ClaudeRabbit is a free, open-source security product protecting the open-source community from malware. We clone any public GitHub repo into an isolated sandbox, run it, and return one honest safety score.

• targate

  github · Free · by marcoabate-ck

  AI-assisted pre-install security gate for npm packages — analyze, decide, and gate a dependency before it runs.

• trusca

  github · Free · by trustedoss

  Self-hosted, open-source SCA portal — vulnerability (CVE), license compliance, and SBOM management in one UI. Black Duck/Snyk-class capabilities, Apache-2.0.

• lopper

  github · Free · by ben-ranford

  measure dependency waste and attack surface before it ships

• franken_node

  github · Free · by Dicklesworthstone

  Trust-native JavaScript/TypeScript runtime platform built on franken_engine with deterministic compatibility, migration autopilot, extension trust controls, and incident replay.

• gradle-wrapper-validator

  github · Free · by dotanuki-labs

  A validator for gradle/wrapper jar binaries, intended to be used in CI pipelines.

• gh-actions-lock

  github · Free · by github

  A gh CLI extension that generates and verifies the GitHub Actions dependency lockfile, pinning every action your workflows use to an exact commit.

• starmetal

  github · Free · by Goldziher

  High-performance, self-hosted multi-language package registry and registry proxy

• nthpartyfinder

  github · Free · by grcengineering

  Discover Nth-party vendor relationships (3rd, 4th, and deeper) for a domain from public signals — DNS, certificate transparency, trust-center subprocessors, web traffic, and more. A fast, offline-capable GRC Engineering CLI in Rust.