Osv Python Packages

univers

Parse and compare package versions and ranges. From debian, npm, pypi, ruby and more. Process all the version range specs and expressions. This project is sponsored by an NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ , the Google Summer of Code, nexB and others generous sponsors!

ca9

CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.

repo-security-scanner

Pre-clone security scanner for Git repos. Detects crypto miners, backdoors, obfuscation, and vulnerable dependencies before git clone touches your machine. Python CLI with JSON/CSV/SARIF output.

package-doctor

Scan Python dependencies for exploited CVEs and abandoned packages that handle untrusted input, ranked by CISA KEV and EPSS. Runs in CI and as a Claude Code hook.

maunprekshak

The Silent Observer — Fast, local-first security scanner for dependencies (SCA), exposed secrets & git history, SAST, Dockerfiles, and GitHub Actions with multi-provider AI remediation.

pyscan-rs

python dependency vulnerability scanner, written in Rust.

vexcalibur

General-purpose VEX toolkit for SBOM-driven vulnerability exploitability workflows.

pixi-sbom

pixi-sbom is a Pixi extension that generates Software Bills of Materials (SBOMs) from Pixi manifests and lock files, supporting dependency visibility, reproducibility, and supply-chain security workflows.

aboutcode-hashid

A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/

vulnerablecode

A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/

sniffmcp-cli

🕵️ Sniff out what your AI tools are hiding. Local security checks for MCP servers: hidden instructions, known malware (checked before launch), leaked credentials, rug pulls.

pwned-deps

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed, --min-age cooling-off gate, exit 4 when a scan is incomplete. SLSA L3, Sigstore-signed feed.

venvy

Offline, machine-wide Python supply-chain security audit - scan every virtual environment for vulnerable & malicious packages. CVE + typosquat detection, agent/CI-ready JSON. Also a lightweight venv manager.

osv-lib

Python library for calling OSV (https://osv.dev/)

tridentchain-mcp

Supply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.

art14

Which SBOM vulnerabilities trigger an EU Cyber Resilience Act Article 14 reporting decision and why.

opencra

Sovereign SBOM scanner & Cyber Resilience Act (CRA) compliance toolkit. Generate CycloneDX/SPDX, detect supply chain CVEs/KEVs, and automate 24-hour incident reporting workflows for EU software vendors.

vulnometry

Measure what a vulnerability is worth to your business, not how severe it is in the abstract. Business Exposure Index scoring over NVD, EPSS, CISA KEV, OSV and GHSA.

tridentchain-security

Supply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.

alnur

ALNUR — Open-source end-to-end security vulnerability scanner. Detects CVEs, hardcoded secrets, architecture flaws, and port risks across Node.js, Python, PHP, Go, Rust, Java, .NET, Ruby and more

cve-sentinel

Skill to detect Vulnerability in your project

basalt-scan

A purple-team of AI agents that audits code security and proves findings by execution — not by opinion.

depdoctor

🔍 A dependency health checker for Python projects — scan for vulnerabilities, outdated packages, unmaintained libraries, and more.

safe-packages

A CLI tool to scan dependencies for vulnerabilities and flags potentially compromised dependencies (supply chain security).