Skip to content

36 results for “Block”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types398Articles166Write-ups79Papers76Repos36Advisories20
Threads11Tools5Talks4Courses1
📦 Repos“Block”Clear all
github.comrepo🛡️ Security

AikidoSec/safe-chain

Aikido Safe Chain is an open-source local proxy and shell-alias wrapper for npm, yarn, pnpm, bun, pip, uv, poetry, pipx and pdm. It checks every package download, including deep dependencies, against the Aikido Intel malware feed and blocks malicious packages before install. It also enforces a configurable 48-hour minimum package age by suppressing too-new versions in registry metadata. It supports custom registries and a self-hosted malware-list mirror, and has CI/CD install recipes for GitHub Actions, Azure Pipelines, CircleCI, Jenkins, Bitbucket and GitLab.

Aikido SecuritynpmPyPI+3
Aikido IntelSafe Chain

Supply Chain, DevSecOps· Added 17 Oct 2026

github.comrepo🧠 AI

browser-use/jev-ultrafast

jev-ultrafast is an open-source browser automation agent (from Browser Use) that represents each page as an indexed element table and uses a 'TypeSafe' policy to speculatively predict both the next operation (CLICK, TYPE_TEXT, SELECT, SCROLL, WAIT, DONE, BLOCKED) and its target in a single network round trip, only invoking a small LLM (e.g. inception/mercury-2.5 via OpenRouter) to generate text when the operation is TYPE_TEXT. The repo includes a local inspector UI, Chrome automation via a 'Browser Harness' tool, offline tests, and published before/after benchmarks showing a Google Flights search dropping from a median 9.45s to 7.09s and browser protocol calls from 1,092 to 101 across repeated runs.

PythonOpenRouterGemini+2
Browser UseJevTypeSafe+2

agents· Added 6 Oct 2026

github.comrepo🛡️ Security

NuvexNetwork/nuvex

Nuvex is a Solana-native verifiable compute and oracle protocol, still pre-mainnet, whose own README documents unresolved security gaps instead of hiding them: its VRF proof verification relies on solana-ecvrf 0.0.1 (RFC 9381 ECVRF-Edwards25519-SHA512-TAI) which has no known audit, max_fee is stored but never actually charged, and VRF fulfillment is first-come among any node meeting the configured stake/heartbeat threshold — meaning an operator who funds several keys at a low minimum stake can selectively pick which randomness output gets used. The deploy-mainnet script is stubbed to exit before any transaction, and unresolved design questions (fee shares, challenge/reject state transitions) are tracked as explicitly blocked ADRs rather than quietly shipped.

SolanaRust
solana-ecvrfRFC 9381ECVRF-EDWARDS25519-SHA512-TAI

Blockchain· Published and added 2 Oct 2026

github.comrepo🧠 AI

https://github.com/Panniantong/Agent-Reach

Agent-Reach is a CLI and agent-"skill" layer that equips coding agents (Claude Code, Cursor, OpenClaw) with ready-made web-reading tool use: fetching arbitrary pages via Jina Reader, YouTube transcripts via yt-dlp, GitHub repos via gh CLI, Bilibili search, RSS via feedparser, and semantic web search via Exa through mcporter, with login-gated platforms (Twitter/X, Reddit, Xiaohongshu, Facebook, Instagram) added on request via cookies or OpenCLI browser sessions. Each platform module probes an ordered list of candidate backends and falls back automatically when one breaks (e.g. yt-dlp being blocked by Bilibili's anti-scraping), and an `agent-reach doctor` command reports which backend each channel is currently using. It positions itself as a "capability layer" that selects, installs and health-checks the right upstream tool for an agent rather than wrapping the reads itself.

Model Context ProtocolClaude CodeCursor+4
OpenCLItwitter-clirdt-cli+9

agents, coding-agents, mcp· Added 2 Oct 2026, published 1 Oct 2026

github.comrepo🛡️ Security

Supply Chain Firewall (Datadog)

Supply Chain Firewall (SCFW) is a Datadog-built CLI that wraps npm, pip, and poetry commands to inspect every package target against known-malicious/compromised package datasets (the open-source malicious-software-packages-dataset and OSV.dev) before installation proceeds, blocking or warning on hits. It ships as a single Go binary, can be aliased transparently into a developer's shell, and optionally reports run outcomes and enforces centralized allow/block policies through Datadog Code Security across a fleet, sending only package metadata (never source code) to Datadog.

npmPyPIGo+2
malicious-software-packages-dataset

Supply Chain, DevSecOps· Added 22 Sep 2026

github.comrepo🛡️ Security

y0usaf/pi-jev

pi-jev is an npm extension (@y0usaf/pi-jev) that adds a typed decision layer to the Pi coding agent: a gate scores pending bash/write/edit tool calls on destructiveness, exfiltration risk, scope, and impact before they run, while an output judge scans bash results for leaked secrets and classifies command failures (retry/environment/code_bug/permission/user_error). Answers come back as probabilities or choice distributions rather than prose, are batched into one API round trip to api.typesafe.ai, cached per input, and fail open on any error so a dead endpoint never blocks the agent. The README documents calibration work behind the thresholds (e.g. destructive=0.90, leak=0.90) derived from repeated fixture runs, and details argument/output truncation and key redaction to limit what leaves the machine.

npmTypeScriptNode.js
TypeSafe

AI Security· Added 26 Sep 2026, published 16 Sep 2026

github.comrepo🛡️ Security

MassPIIFinder v2

MassPIIFinder v2 is a Python recon tool that automates crawling a target's in-scope JavaScript (multi-hop HTML crawl, dynamic imports, chunk manifests, sourcemaps, plus optional passive CT-log subdomain discovery) and mines it for API keys, tokens, credentials, internal endpoints, and PII using ~90 named patterns plus a high-entropy freeform heuristic. Findings are validated offline (Luhn checks, JWT decode, AWS key-shape) and via scope-checked, rate-limited reachability probes, then triaged by severity and exported as JSON/HTML/SARIF/Markdown/CSV. It enforces authorization with a required --confirm-authorized flag and a ScopeGuard that blocks any out-of-scope requests, and explicitly avoids testing leaked keys against third-party providers or exploiting findings.

PythonFlaskSQLite+1

OSINT, AppSec· Added 22 Sep 2026, published 15 Sep 2026

github.comrepo🛡️ Security

DeathShotXD/0xCr0ssCrush

Research project on two signed vulnerable Windows drivers, DCRCVDrv.sys (MOCOMSYS) and Alinubx.sys (CnCrypt), abused by the Cruciferra MaaS loader to kill AV/EDR processes. It documents their devices, IOCTLs (0x2205C0, 0x222024) and the termination chain (ObOpenObjectByPointer -> ZwTerminateProcess), and gives annotated disassembly, hash-level sample provenance and blocklist-status snapshots. It includes a Rust lab harness with hash validation and dry-run, plus Sigma, YARA and telemetry guidance. Findings carry evidence labels, and the test matrix is limited to Windows 11 24H2 with HVCI disabled.

WindowsRustSigma+2
BYOVDCruciferraDCRCVDrv.sys+7

Malware & RE, Blue Team & Detection, Offensive Security· Added 11 Oct 2026, published 14 Sep 2026

github.comrepo🧠 AI

bsab/sweden-mcp-servers

A community-maintained catalog of Model Context Protocol servers connecting AI assistants to Swedish data, laws and services (e.g. Fortnox, Bokio, BolagsAPI, ICA), forked/adapted from the France and Italia MCP Servers projects. Each entry is checked against canonical documentation, tracks license/credential requirements, and includes a runtime smoke-test report (protocol/tool call attempts, credential blockers, failures) plus a six-criterion documentation-readiness rubric, published as a static JSON/HTML site.

Model Context ProtocolPython
FortnoxBokioBolagsAPI+3

mcp· Added 26 Sep 2026, published 14 Sep 2026

github.comrepo🛡️ Security

mukul975/cve-mcp-server

cve-mcp-server is a Model Context Protocol server that gives Claude direct access to 28 security tools spanning 24 APIs (NVD, EPSS, CISA KEV, OSV.dev, GitHub GHSA, MITRE ATT&CK, AbuseIPDB, GreyNoise, Shodan, VirusTotal, MalwareBazaar, ThreatFox, Ransomwhere, and more), fronted by a one-call triage_cve orchestrator. It computes a composite 0-100 risk score from CVSS, EPSS, KEV status, and PoC availability (with a hard CISA KEV override forcing CRITICAL/≥76), supports dependency scanning via OSV, IP/domain reputation lookups with private-IP blocking, and ships an SSVC v2 gated decision mode plus audit logging and XML-bomb protections via defusedxml.

Model Context ProtocolClaude DesktopClaude Code+9
CVE-2021-44228CVE-2024-3400CVE-2023-44487+3

AI Security, Threat Intel· Published and added 7 Sep 2026

github.comrepo🛡️ Security

Numbat

Numbat is a Go-based, single-binary endpoint agent from Perplexity AI that gives visibility into AI coding-agent activity (Claude Code, Codex, OpenClaw, and other CLI/IDE/gateway agents) by capturing events through local hooks, OTLP/HTTP logs, and on-disk session artifacts. It normalizes activity into one event model, evaluates it with a local CEL rule engine (including multi-step sequence rules like secret-read-then-egress), and can optionally block matched actions via synchronous pre-action hooks (deny/monitor decisions), with case bundles and SHA-256 manifests for forensic reconstruction. Example built-in rules detect cloud-metadata SSRF requests (169.254.169.254) and credential-exfiltration chains, mapped to MITRE ATT&CK technique tags.

Claude CodeCodexOpenClaw+2
T1048T1552T1567

AI Security, Blue Team & Detection· Published and added 5 Sep 2026

github.comrepo🛡️ Security

DataSentry

DataSentry is a Claude Code plugin that redacts secrets (AWS keys, tokens, credentials) from tool outputs before they enter the model's context window, using deterministic hooks rather than model instructions, and blocks prompts that contain live credentials. It ships 40 regex-based detection rules (ported from an enterprise Warp ADE ruleset), stable per-secret placeholders via sha1 hashing, per-category overrides, an audit log, and a fail-closed mode; PII/financial/healthcare pattern detection is reserved for a paid Enterprise tier.

Claude CodePython
Warp

AI Security, DevSecOps· Published and added 27 Aug 2026

github.comrepo🧠 AI

xiaoyeuzixi/revlab

REVLab is a Windows-local binary analysis workbench for PE files, Unreal Engine dumps and Unity game folders. Its graph workflow engine runs LLM analysis nodes as tool-calling operators: up to 6 tool rounds by default, a target path locked by the workflow, a saved tool_trace, and a read-only fallback when the gateway lacks tools support. Evidence is labelled static, runtime, inferred or blocked, and model output is capped at ai_inferred. An MCP server lets external agents read evidence and submit conclusions.

PythonFastAPISQLite+9
REVLabCodexClaude Code+3

agents, mcp· Added 23 Oct 2026, published 11 Aug 2026

github.comrepo🛡️ Security

xiaoyeuzixi/revlab

REVLab is a local Windows binary analysis workbench covering generic PE files, Unreal Engine dumps and Unity game directories. It splits work into stages (identify, unpack, disassemble with Capstone, decompile with Ghidra Headless, gated local dynamic run) stored per sample in SQLite. A Vue Flow workflow editor, AI tool-loop nodes and an MCP server let external agents drive analysis, with evidence labelled static, runtime, inferred or blocked.

GhidraModel Context ProtocolPython+2
PE-sieveUPXUnreal Engine+7

Malware & RE, AI Security· Added 23 Oct 2026, published 11 Aug 2026

github.comrepo🧠 AI

Leonxlnx/unlazy

unlazy is an agent skill for Claude Code, Codex CLI and other agent harnesses that enforces "completion discipline": before AI-agent work is reported done, it must satisfy a ledger of runnable gates (GATES.md) whose shell/Node checks are executed and whose output must match a declared EXPECT: string, with digest-bound evidence, approval records, and --reverify to re-run already-"complete" gates. It also provides scoped multi-leaf/branch orchestration with lease-based claiming for parallel agent dispatch, a Claude Code Stop-hook that blocks premature completion, and documentation of the threat model (shell resolution, PATH, approval storage) around executing arbitrary checker commands. The README grounds the design in cited research on LLM laziness, premature truncation, and over/under-thinking (e.g. METR's Time Horizon, SlopCodeBench, OptimalThinkingBench, s1), while being explicit that this research motivates but does not prove the tool's effectiveness.

Claude CodeCodexNode.js+1
METRSlopCodeBenchOptimalThinkingBench+2

coding-agents, agents· Added 2 Oct 2026, published 9 Aug 2026

github.comrepo🛡️ Security

SiberKapan

SiberKapan is a Turkey-focused, community-driven open-source threat intelligence platform that aggregates data from FortiGate webhooks, an 11-service honeypot (HoneypotKapan), nginx/Fail2ban log watchers, and external feeds, publishing it as STIX 2.1/TAXII 2.1, a MISP default feed, Sigma/Suricata/Wazuh exports, and REST blocklists. It also runs a real-time phishing/domain-squatting detector via Certificate Transparency log monitoring with fuzzy typosquat and Punycode/IDN decoding, and safely fingerprints SSH-honeypot malware downloads with SSRF-protected, never-executed hashing enriched via MalwareBazaar. The write-up details concrete anti-abuse safeguards: time-based IP score decay, CDN/cloud-proxy allowlisting, UDP-spoofing exclusion, RFC1918 rejection, and manual review gating for weak phishing signals.

MISPFortiGateSuricata+3
CISA KEVAbuseIPDBMalwareBazaar+1

Threat Intel, Blue Team & Detection· Published and added 8 Aug 2026

github.comrepo🛡️ Security

aurscan

aurscan is a Go-based CLI that hooks into yay/paru to scan a downloaded AUR package's PKGBUILD, .install scriptlets, .SRCINFO and helper scripts before makepkg runs, blocking the build if it looks malicious. It combines offline, quote-aware static rules covering known AUR campaign signatures such as disguised source patch URLs, install-scriptlet worms, masqueraded binary file types, and editor auto-exec triggers with an LLM auditor (Claude Code, Codex, Anthropic API, or a local OpenAI-compatible model) that answers a fixed checklist of yes/no behavioral questions, from which aurscan deterministically derives a verdict, severity and confidence, and fails closed when no backend is available. It documents and defends against real incidents including the July 2025 firefox-patch-bin CHAOS RAT vector, the June 2026 Atomic Arch mass orphan-package takeover pulling a Rust stealer and eBPF rootkit, and the August 2026 xsnow dot-install worm that harvested SSH keys and self-propagated across AUR.

GoClaude CodeCodex CLI+3
CHAOS RATAtomic Archxsnow+4

Supply Chain, AI Security· Published and added 8 Aug 2026

github.comrepo🛡️ Security

TRONSEC

TRONSEC is an open-source, browser-based security workbench for the TRON blockchain (TRX mainnet) that lets users inspect wallet addresses, TRC-20 token approvals, smart contracts, transaction calldata, and URLs for risk without connecting a wallet or holding custody. It bundles a wallet risk scanner, AML/sanctions-exposure heuristics, an unlimited-approval monitor, a contract-privilege/proxy checker, a transaction decoder that flags drain patterns, a phishing/typosquat URL checker, and a local in-browser vanity address generator. Production API keys for TronGrid, TronScan, and VirusTotal are kept server-side via a Cloudflare Worker proxy rather than shipped in client JS.

Cloudflare WorkersVirusTotal

Blockchain· Published and added 5 Aug 2026

github.comrepo🛡️ Security

Kritt-ai/open-kritt

open·kritt is a self-hosted, open-source platform that orchestrates AI coding agents (Codex, Claude Code, or Grok Build) in parallel to hunt for vulnerabilities in remote or local repositories and their dependencies. It breaks security research into small chained prompt "workflows," runs jobs in disposable root-access Docker containers with internet access, then de-duplicates and ranks findings, validates them via post-scripts/PoC generation, and exports share-safe finding bundles. It's the open-source distillation of the internal tooling behind the Kritt team's (Blockian) $1.5M+ in bug-bounty payouts.

Claude CodeCodexGrok+3
Blockian

AI Security, AppSec, Offensive Security· Published and added 2 Aug 2026

github.comrepo🛡️ Security

QM

QM is an MIT-licensed, self-hosted "multiplayer" agent harness that lets a company deploy a shared coding/ops agent across Slack and a web app, with per-person and per-room isolated sandboxes, memory, keychains, permissions, and crons. Its security model centers on an org-wide posture (Strict pauses every tool call for approval; Auto blocks private-network access and applies optional content screening; Dangerous disables both) layered under a predeclared command policy that hard-denies things like recursive deletes, plus an explicit Isolated/Open sharing posture that governs cross-scope memory and file access with provenance labeling and audit trails. It supports pluggable harnesses (Pi, OpenCode, Codex, Claude Code) behind a common core and documents its threat model and operator assumptions in SECURITY.md.

Claude CodeOpenCodeCodex+3

AI Security· Added 3 Sep 2026, published 1 Aug 2026

github.comrepo🛡️ Security

ShortDot Zone Abuse Evidence

PhishDestroy's shortdot-evidence is a daily-updated GitHub investigation into ShortDot SA, the Luxembourg registry operator behind the .icu, .bond, .cyou, .sbs, .cfd, .buzz and .qpon gTLDs, documenting that 51,985+ tracked domains impersonate brands like Chase, Binance, MetaMask and Ledger and that ~70% of registered domains in these zones carry no DNS records (metric-padding rather than legitimate use). It publishes machine-generated IOC/blocklist files and analytics built from a per-TLD zone-file pull cross-referenced against Spamhaus DBL, SURBL, OpenPhish, URLhaus, PhishTank and AlienVault OTX, and ties the zones to concrete criminal cases (FBI's LabHost domain list, Google v. DOES/Yucheng Chang RICO suits, the Revolver Rabbit XLoader/Formbook C2 campaign using 500k+ .bond domains). It also details structural conflicts of interest between ShortDot, its registry infrastructure provider Team Internet Group/CentralNic, registrar partner NameSilo, and the brand-protection vendor NameBlock, backed by Interisle Consulting Group phishing-volume statistics.

SpamhausSURBLURLhaus+3
ShortDot SANameSiloNameBlock+16

Threat Intel, OSINT· Published and added 25 Jul 2026

github.comrepo🛡️ Security

Awesome AI Web3 Security

A curated, verified awesome-list of AI-powered tools for smart contract and blockchain security, covering autonomous auditor agents (Hound, Plamen, Aether, SolidityGuard), commercial AI audit platforms (Sherlock AI, Cantina Apex, Zellic V12, Nethermind AuditAgent), MCP-based auditing plugins (Trail of Bits Skills, Claudit, Slither MCP, Solodit MCP Server), real-time on-chain ML monitoring (Forta Network, AnChain.AI), and benchmark/training datasets (EVMbench, SCONE-bench, ScaBench, SmartBugs). Every entry requires a real AI/ML/LLM component plus a specific Web3 security focus, with open-source entries needing 25+ GitHub stars, positioning it as a practical index for the emerging AI-driven smart-contract-audit tooling ecosystem.

SolidityEthereumSolana+3
Trail of BitsCertoraForta Network+9

AI Security, AppSec· Added 3 Sep 2026, published 18 Jul 2026

github.comrepo🛡️ Security

EVM Hack PoC

A public GitHub repository aggregating proof-of-concept exploit archives for EVM (Ethereum Virtual Machine) smart contract hacks, generated from the companion evm-hack-registry dataset and meant to be consumed by the evm-hack-analyzer tool. It's positioned as raw material for blockchain security research, education, and building automated PoC-analysis tooling rather than a single vulnerability writeup.

Ethereum
evm-hack-registryevm-hack-analyzer

Offensive Security· Added 3 Sep 2026, published 18 Jul 2026

github.comrepo🛡️ Security

Strix

Strix is an open-source framework of autonomous AI pentesting agents that dynamically run target code, discover vulnerabilities across the OWASP Top 10 (SQLi, SSRF, XXE, IDOR, XSS, auth bypass, business-logic flaws) and validate them with working proof-of-concept exploits rather than static-analysis heuristics. It ships a CLI with a full offensive toolkit (Caido-based HTTP interception, browser exploitation, Python exploit sandbox, recon/OSINT, SAST/DAST), supports OpenAPI/Postman-driven black-box testing, integrates into GitHub Actions/CI pipelines to block vulnerable PRs, and can run against local or hosted LLMs via LiteLLM, with an optional cloud offering for autofix PRs and compliance reporting.

DockerLiteLLMCaido+3
OWASP Top 10

Offensive Security, AI Security, DevSecOps· Published and added 15 Jul 2026

github.comrepo🛡️ Security

Destructive Command Guard (dcg)

Destructive Command Guard (dcg) is a Rust-based hook that intercepts and blocks catastrophic commands (git reset --hard, rm -rf, DROP TABLE, kubectl delete namespace, terraform destroy, etc.) before AI coding agents like Claude Code, Codex CLI, Gemini CLI, GitHub Copilot CLI, and Cursor can execute them. It uses a modular "pack" system covering 50+ categories (databases, cloud providers, Kubernetes, secrets managers, CI/CD, storage, DNS, payments) plus a three-tier heredoc/inline-script AST scanning pipeline to catch destructive commands hidden inside python -c/bash -c payloads, and a dedicated "careful_company_running_windows" preset that also blocks data-exfiltration channels (webhooks, uploads, tunnels) and attempts to disable security controls. Configurable via TOML with agent-specific trust profiles, allowlists, and fail-closed/fail-open policies for unattended agent sessions.

Claude CodeCodex CLIGemini CLI+3

AI Security, DevSecOps· Published and added 15 Jul 2026

github.comrepo🛡️ Security

HOL Guard

HOL Guard is an open-source local "antivirus" runtime protection layer for AI coding agents that intercepts shell commands, file access, package installs, and MCP tool calls before execution, classifying them for secret exposure, destructive operations, prompt injection, and supply-chain risk, then allowing/blocking/requesting approval per policy. It integrates via native hooks and managed MCP proxies with Codex, Claude Code, GitHub Copilot CLI, Cursor, Cline, Gemini CLI, Grok, and other agents, and includes a supply-chain package/advisory checker (hol-guard supply-chain scan/explain). The repo also bundles plugin-scanner, a companion CLI/GitHub Action that lints and scores agent plugins, skills, and MCP integrations for manifest issues, secrets, MCP transport risks, and dependency/lockfile problems, producing SARIF/JSON reports for CI gating.

Model Context ProtocolCodexClaude Code+5
HOL Guardplugin-scannerHCS-28

AI Security· Published and added 15 Jul 2026

github.comrepo🛡️ Security

SreeragPramod/securepipe

SecurePipe is a small demo GitHub repo showing a GitHub Actions CI/CD pipeline for a Python project that runs Flake8, Black, Bandit SAST scanning, and pytest with an 80% coverage gate before code can be merged. Its commit history documents a real vulnerability lifecycle: a hardcoded database password (Bandit rule B105) and a shell-injectable subprocess call (Bandit rule B602) were intentionally introduced, automatically blocked by the Bandit gate, then fixed by moving secrets to environment variables and replacing shell=True with an explicit argument list and host allowlist.

GitHub ActionsPythonBandit
B105B602

DevSecOps, AppSec· Published and added 15 Jul 2026

github.comrepo🛡️ Security

Protect AI llm-guard

LLM Guard (Protect AI) is an open source Python toolkit that wraps input/output scanners around LLM applications to detect and block prompt injection, PII/data leakage, toxic or harmful content, and other unsafe interactions, with a pip-installable library and API deployment option. The project has since been archived and is no longer maintained, though the code and associated Hugging Face models remain publicly available.

PythonHugging Face

AI Security· Added 3 Sep 2026, published 14 Jul 2026

github.comrepo🛡️ Security

apisec-inc/AI-Surface

ai-surface is a local/offline static analysis CLI (apisec-inc) that scans a codebase for AI attack surface — LLM SDK calls, agent frameworks (LangChain, AWS Strands), MCP servers, RAG/vector stores, model gateways, and provider keys — and flags risk indicators such as financial-action tools with no human approval or unverified MCP servers. It generates an AI-BOM (CycloneDX), SARIF for GitHub code scanning, and maps findings to OWASP LLM Top 10, EU AI Act, NIST AI RMF, and ISO/IEC 42001, with a baseline+fail-on-severity workflow for gating new risk in PRs without blocking on pre-existing debt.

Model Context ProtocolLangChainPython+4
OWASP Top 10 for LLM ApplicationsEU AI ActNIST AI RMF+1

AI Security, DevSecOps· Published and added 11 Jul 2026

github.comrepo🛡️ Security

CVE Lite CLI

CVE Lite CLI is an OWASP Lab Project CLI that scans npm, pnpm, Yarn, and Bun lockfiles against OSV and the npm advisory API and outputs copy-and-run fix commands instead of raw CVE lists, with parent-aware guidance for transitive dependencies. Beyond core CVE scanning it audits override/resolution hygiene, flags maintenance risk (deprecated direct deps and version drag blocking fixes), warns when a suggested fix falls inside a package manager's release-cooldown window (referencing the chalk/debug npm compromise), and emits SARIF, SPDX/CycloneDX SBOMs, and EPSS-based priority tiers, plus a GitHub Action that opens batched fix PRs.

npmpnpmYarn+3
chalk

Supply Chain, DevSecOps· Published and added 31 May 2026

Showing 30 of 36

Show more