Skip to content

Back to the catalog

One year of Opengrep: What we built and what’s next
aikido.devarticle

One year of Opengrep: What we built and what’s next

Aikido Security recaps the first year of Opengrep, the LGPL-licensed fork of Semgrep created by a consortium of security vendors to keep advanced static analysis open source. It details engine work (OCaml 5 migration with shared-memory parallelism, intrafile cross-function taint analysis via --taint-intrafile, native Windows support, new language support for Visual Basic/Apex/Elixir/Clojure), performance gains (25-74% faster scans, 2x faster taint analysis), adoption metrics, and a maintainer Q&A that admits a PyPI package-hijack risk from an unsecured package name/misconfiguration. It closes with a roadmap toward interfile taint analysis and full removal of the Python wrapper.

TL;DR One-year retrospective on Opengrep, the open-source Semgrep fork, covering its OCaml 5 rewrite, cross-function taint analysis, performance gains, a disclosed PyPI package-hijack risk, and roadmap toward interfile taint analysis.
Open original ↗
Document

What it is

Opengrep is an open-source fork of Semgrep's SAST engine, maintained by Dimitris Mostrous, Maciej Piróg, and Corneliu Hoffman under LGPL-2.1. This post gives the concrete deltas versus Semgrep CE after one year — the specific features, flags, and one security incident that the summary omits.

How it works / What's different

Opengrep ships as a self-contained binary with no Python dependency, native Windows support, and telemetry/proprietary service dependencies removed. It runs on OCaml 5 with shared-memory parallelism (Semgrep has since followed with its own OCaml 5 and Windows work).

Capabilities not in Semgrep CE at fork time:

  • Cross-function (intrafile) taint analysis, enabled with the --taint-intrafile flag, including higher-order functions across multiple languages.
  • Added languages: Visual Basic, Apex, Elixir, plus Clojure taint support.
  • Operational features: per-rule timeouts, dynamic timeouts based on file size, configurable ignore annotations.

Claimed measurements (vendor's own numbers): 25–74% faster full-ruleset scans on large repos; up to 2× faster taint analysis; better multi-hop taint detection (cited example: 25 findings vs 5 on ComfyUI). 1.74M binary downloads, 2,000+ GitHub stars, 10 companies in production.

What to do

If you already run Semgrep rules, Opengrep is described as fully compatible with existing rules and configurations, so it's a low-friction A/B test. To exercise the differentiating feature:

opengrep --taint-intrafile

Prefer the GitHub release binary over the pypi package — see the caveat below.

Caveats

  • PyPI package-hijack exposure (self-reported). The maintainers state they did not secure the package name on PyPI and distributed wheels on release; combined with a misconfiguration, this "created a pathway for a malicious user to hijack the package." The post does not say it was exploited, nor that it's fully resolved. Treat the PyPI distribution path with caution and verify what you install.
  • Numbers are the vendor's. All performance and detection figures come from Aikido/the maintainers; no independent reproduction is cited.
  • Contribution barrier is high. ~200k lines of OCaml; only 17 external contributors / 29 PRs in year one. Most development is the three core maintainers — a bus-factor consideration if you depend on it long-term.
  • The determinism argument (same code + rules → same findings, unlike probabilistic AI scanners) is a positioning claim relevant if you need reproducible CI/CD or compliance output.

Technologies named here

Techniques named here

  • Cross-function taint analysis
  • Interfile taint analysis
  • Package name hijacking

Related in AppSec