Supply Chain Python Packages

pip-audit

Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them

sigstore

A Sigstore client written in Python

in-toto

in-toto is a framework to protect supply chain integrity.

ochrona

A command line tool for detecting vulnerabilities in Python dependencies and doing safe package installs

model-signing

Supply chain security for ML

skjold

Security audit Python project dependencies against security advisory databases.

stockpyl

Python inventory optimization and simulation tools.

stillrunning

Enterprise security and monitoring for developers. pip install stillrunning

openclaw-skill-vetter-mcp

MCP server for security-vetting third-party AI agent extensions before installation — Claude skills, plugins, tool packs. 41 detection rules across prompt-injection, exfiltration, dynamic execution, typosquats. 0-100 risk score.

ossguard

OSSGuard Python implementation — reference CLI with Rich UI (pip install ossguard)

otterdog

Tool to manage GitHub organizations and their repositories.

dppvalidator

dppvalidator is the "GDPR compliance engine" for physical products, enforcing the strict digital syntax required for the EU's Digital Product Passport.

openpartslibrary

Python library for creating a database of hardware components for manufacturing

pip-abandoned

📦 Search for abandoned and deprecated python packages

pyraider

Using PyRaider You can scan installed dependencies known security vulnerabilities. It uses publicly known exploits, vulnerabilities database.

tap-socketdev

Singer tap for socket.dev

chainjacking

A tool to scan your direct GitHub dependencies for Go and find ones susceptible to ChainJacking attack

gitxray

A multifaceted security tool which leverages Public GitHub REST APIs for OSINT, Forensics, Pentesting and more.

deepbullwhip

Multi-tier supply chain bullwhip effect simulator

cra-sbom-evidence

CRA Article 14 evidence pack from your SBOM and VEX feeds. Every clause cited verbatim. Every output hashed.

aztec-py

GS1 2027-compliant pure-Python Aztec Code generator. FLG(0) Reader Initialisation, batch encoding, SVG/PDF/PNG, CLI, boarding passes, GS1 labels. ISO 24778.

macro-supply-signals

Macro-economic indicator library for supply-chain signals

or-gym

OR-Gym: A set of environments for developing reinforcement learning agents for OR problems.

x12-python

The ultimate Python toolkit for X12 EDI processing