GitHub Advanced Security
Dependency review, code scanning and secret scanning with push protection.
Supply Chain
Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Addresses 190 stories in our coverage in the last 90 days 6 products that provide it
What it is
Analysis of the open-source components in your software, blocking of malicious packages, software bills of materials (SBOMs) and protection of build pipelines.
How to value it
Malicious npm and PyPI packages are published every day, and one poisoned dependency can reach thousands of companies. Knowing what is inside your software, and stopping bad packages at the door, is also becoming a legal duty for products sold in the EU under the Cyber Resilience Act.
Questions to ask a vendor
- 1Does it detect malicious packages, not just known vulnerabilities?
- 2Can it block a bad package before a developer installs it?
- 3Does it produce SBOMs in standard formats such as CycloneDX and SPDX?
- 4How does it rank vulnerabilities that our code can actually reach?
For your risk register
- Risk
- Compromised or vulnerable open-source components enter our products.
- Control
- Component analysis with malicious package blocking, and an SBOM for every release.
- Owner
- Engineering lead.
- Measure
- Releases with an SBOM, and open critical findings.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
JFrog Curation
Blocks malicious and risky open-source packages before they enter your repositories.
JFrog Xray
Software composition analysis and SBOM generation for artifacts.
Snyk Open Source
Finds and fixes vulnerable open-source dependencies in code and pipelines.
Socket
Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.
Sonatype Firewall
Blocks malicious and policy-violating open-source components at download.
Recent stories it addresses
709 stories in total- 17 Oct 2026MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Malicious npm package 'imgdecode' hides shellcode loader in Windows native addon.
- 16 Oct 2026Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers tampered with AOMEI Backupper update servers to deliver a backdoor.
- 15 Oct 2026Fake Arch Linux packages push malware with root privileges
Malicious Arch Linux packages impersonating popular tools delivered malware with root privileges.
- 15 Oct 2026Anthropic Gives Open Source Maintainers a Fast Track to Mythos Vulnerability Findings
Anthropic launches OSS Scanner to help open source projects find vulnerabilities faster.
- 15 Oct 2026Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js releases patch for two critical RCE flaws in caching and SVG processing.
- 15 Oct 2026PEP 829 Makes Python Startup Safer, But Risk Remains
Python 3.15's PEP 829 improves startup security but doesn't fully prevent malicious code execution.
- 13 Oct 2026SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
SAP Cloud SDK for Python has critical CVSS 10 flaw allowing OAuth2 credential theft.
- 13 Oct 2026GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub expires npm trusted publishing configs after 48 hours to prevent package hijacking.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.