Endor Labs
Named by 103 kept items in this workspace.
63 items name it under classification.technologies, 35 under tools and 5 under classification.key entities.
The items that name it 103
Bazel-native software component discovery and SCA scanning of software supply chain
publisher; SBOM management from multiple sources
SCA platform with function-level reachability analysis, call graphs, phantom dependency detection
software supply chain security vendor; offers help securing the software supply chain
static SCA with reachability analysis on source code to filter issues by whether code calls the vulnerable code
Measures vulnerability blast radius with reachability analysis across code and dependencies
Vendor product performing reachability-based SCA (software composition analysis), shown reducing findings by 94% in example; offers free 30-day trial
Supports SSDF compliance across secure environments, trusted source code supply chains, code/artifact provenance, and vulnerability scanning & remediation
Reachability-based Software Composition Analysis tool that finds known OSS vulnerabilities, prioritizes remediation across multiple filters, and sets rego-based policies to detect and route new findings (warn developers, block commits, generate Jira tickets, emails, Slack notifications, etc.); offer
SCA platform for identifying OSS components/dependencies, generating SBOMs and VEX documents, function-level reachability analysis to prioritize OSS vulnerabilities, package security research/scoring (150+ checks) to select better open source dependencies, and defending against OWASP OSS Top 10 risk
Software composition analysis (SCA) with function-level reachability analysis, container vulnerability scanning, upgrade impact analysis, Endor Magic Patches for remediating vulnerabilities without breaking changes, low-code/no-code artifact signing and verification, and policy integrations with Git
Software supply chain security platform providing dependency intelligence, SBOM generation, vulnerability detection with function-level reachability analysis, repository security posture management, build attestation, secrets scanning, and dependency health monitoring
software supply chain security; publisher offering resources including '40+ AI Prompts for Secure Vibe Coding' and MCP servers for real-time security context and guardrails
Vendor offering services to help secure the software supply chain (referenced at end of article)
Vendor providing security intelligence integrated into AI-driven development workflows
Analyzes packages using 150+ signals of supply chain risk (security vulnerabilities, malicious code, license compliance, project activity, code quality); scans actual code of dependencies for suspicious behaviors rather than relying solely on CVE databases; provides policy-based enforcement for CI/C
Security intelligence platform for agentic software development, offering AI SAST, reachability-based SCA, and dependency management research
Builds a call graph to determine whether vulnerable code is actually reachable/called, cutting vulnerabilities needing remediation by up to 80% and noise by up to 95%
Platform offering full stack reachability analysis, SAST, SCA, secrets scanning, AI code review on pull requests (developer/architect/security engineer perspectives), and evidence-based remediation (backported patches) for AI-generated code
Software supply chain security platform; blocks malware before install when an AI agent runs npm or pip install, adds AI security code review to pull requests, and provides reachability-based prioritization (builds a call graph and uses full stack reachability to show which findings can actually be
Governs AI coding agents via deterministic allow/deny/audit decisions on agent actions; provides security for coding agents and workstations, code review with full stack reachability
Application security monitoring platform for AI-assisted development; uses function-level reachability analysis to cut noise by up to 92%, ranks findings by exploitability, watches dependency drift, reachability changes, and secret exposure
Builds a call graph of an application to determine function-level reachability of vulnerabilities; correlates findings across scan types; generates SBOM and VEX documents backing determinations
Security vendor actively tracking the campaign, verifying newly published malicious versions, and updating affected-package coverage; author of this advisory and planning a follow-up technical write-up
Software supply chain security platform offering reachability analysis, automated patch generation, and upgrade impact analysis as part of agentic remediation
Full-stack reachability analysis platform covering first-party code, open-source dependencies, and container images in a unified code context graph; provides function-level reachability with call-chain evidence, phantom dependency detection, package baselining, and pairs reachability with upgrade im
detects and blocks malicious packages before they reach production; offers dependency firewall, SCA, reachability analysis for AI-suggested dependencies
Uses function-level reachability analysis to cut dependency noise by 95% and surface AI-introduced open source dependency risk that actually reaches production; scans direct and transitive dependencies for vulnerabilities and malware
Security verification and evidence layer for agentic code security programs; provides findings, reachability and call paths, upgrade impact analysis, and license risk data to reduce agent token usage (used by Cursor, OpenAI, and other AI pioneers per the page)
Commercial package firewall/supply-chain security product
Discovers AI models and AI services used across codebases; provides AI model governance, full-stack reachability analysis to determine exploitability of AI-related vulnerabilities, policy enforcement for AI model usage, and continuous monitoring of advisories/risks affecting AI dependencies; combine
Security firm that published a report on the campaign; researcher Peyton Kennedy quoted on OIDC trust scope issue
In every workspace you can read 104
Security
All technologies in this workspace.