Osv Python Packages

ca9

CA9 is a local evidence engine for Python AppSec triage. It sits after scanners and before engineers waste time, proving which findings matter.

univers

Parse and compare package versions and ranges. From debian, npm, pypi, ruby and more. Process all the version range specs and expressions. This project is sponsored by an NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ , the Google Summer of Code, nexB and others generous sponsors!

pyscan-rs

python dependency vulnerability scanner, written in Rust.

aboutcode-federated

Federated data utilities

aboutcode-hashid

A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/

vulnerablecode

A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/

cve-sentinel

CVE auto-detection and remediation proposal system for Claude Code

tridentchain-mcp

Supply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.

tridentchain-security

Supply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.

vulnhunter

Offline vulnerability scanner with AI triage — your dependencies have secrets, VulnHunter finds them.

osv-lib

Python library for calling OSV (https://osv.dev/)

depdoctor

🔍 A dependency health checker for Python projects — scan for vulnerabilities, outdated packages, unmaintained libraries, and more.

alnur

ALNUR — Open-source end-to-end security vulnerability scanner. Detects CVEs, hardcoded secrets, architecture flaws, and port risks across Node.js, Python, PHP, Go, Rust, Java, .NET, Ruby and more

mujin-agentlock

npm audit for your AI agent's extensions: inventory installed MCP servers/skills and flag known-vulnerable (OSV), abandoned, and unpinned ones in CI.

mlsupplychain

Security and compliance scanning for machine learning pipelines. Detects malicious pickles, leaked secrets, vulnerable dependencies.

safe-packages

The cli tool for checking the security of the packages.

pwned-deps

Drop your lockfile in, find out if you're pwned. Compromised-package scanner backed by OSV.dev.

devinder-supply-chain-scanner

Supply Chain Scanner is a local-first security tool that scans your project dependencies, developer environment, and IDE extensions for known vulnerabilities using multiple intelligence sources (OSV, NVD, GHSA, Sonatype), then prioritizes remediation with KEV/EPSS insights and easy-to-read reports — with no API key required for default use.

rtx-trust

Real Tracker X: cross-ecosystem dependency trust scanner