Endor Labs Open Source
Named by 5 kept items in this workspace.
Search every workspace for Endor Labs Open Source. It matches the name as written, so it can find other things that share it.
The items that name it 5
SBOM and VEX generation using source code as source of truth, includes reachability data and mapping of direct and transitive dependencies
Generates SBOM and VEX documents; uses static analysis to build a callgraph of dependency relationships and determine reachability, automatically including reachability data and annotating whether an application or library is affected by a vulnerability
Monitors OSS dependencies for known malicious packages and suspicious code/behaviors; creates critical findings/alerts for confirmed malicious packages (via OSV comparison) and low-severity warnings for suspicious-but-unconfirmed code, using a malware scanner with rules covering JavaScript (npm) and
Reachability-based software composition analysis (SCA); provides accurate inventory of direct and transitive (including phantom/undeclared) dependencies, function-level reachability prioritization, supply chain attack detection (OSS Top 10 risks including malware, outdated, and unmaintained dependen
Software composition analysis (SCA) platform that computes the Endor Score, facts, and policies to evaluate OSS package risk; includes artifact signing, SBOM and VEX generation, pre-merge checks, and DroidGPT AI-assisted OSS selection
All technologies in this workspace.