#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
iulianvostrut/contexthoundStatic analysis CLI that scans codebases for LLM prompt-injection, data-exfiltration, jailbreak, and unsafe agent/tool vulnerabilities. Runs fully…
studiomeyer-io/mcp-server-attestationLayer-2 supply-chain hardening for MCP servers — Ed25519-signed tool manifests, runtime spawn-attestation, default-deny argument sanitizer. Defends…
xiaoqimikko/spring-cvss-checkScans Java artifacts and source for Spring/Tomcat CVEs, compares vendor vs NVD CVSS scores, verifies exploitability conditions, and checks if fix…
heroku/heroku-cve-2013-0269Inspect all of your Heroku apps for vulnerable versions of the JSON gem
michel-dv/xz-utils-backdoor-case-studyTechnical case study of the XZ Utils backdoor (CVE-2024-3094), covering supply-chain trust abuse, malicious release artifacts, build-stage injection,…
knqyf263/go-mal-pkgsA security tool to detect malicious Go packages by verifying checksums in go.sum against the original source code
padayali-jd/pollyscanA specialized vulnerability scanner designed to detect CVE-2024-38526, the Polyfill.io Supply Chain Attack, helping organizations identify and…
leitwacht/leitwachtLeitwacht control plane — runtime security for GitLab Runner CI/CD: policy authoring, multi-tenancy, audit, GitLab integration
ianyong/cve-2022-32223Demonstration exploit for CVE-2022-32223: DLL hijacking in Node.js on Windows via malicious providers.dll, targeting OpenSSL installations.
studiomeyer-io/mcp-stdio-shellguardDefense-in-depth bundle for MCP stdio servers: drop-in guardExec/guardSpawn wrappers, AST audit CLI, reference MCP server. Closes the Ox-Security…
hackerhermanos/cve-2024-3094_xz_checkThis repository contains a Bash script and a one-liner command to verify if a system is running a vulnerable version of the "xz" utility, as…
williavs/nextjs-security-updateBatch upgrade all your Next.js apps to patched versions - fight back against CVE-2025-55183/55184/67779
xiaoqimikko/async-http-client-checkSelf-hosted AI workspace with agents, skills, and tools (Gmail, Calendar) that runs entirely on your own provider API keys (BYOK). Bring your own…
vulnz/sastFree offline SAST engine for CI/CD: AST and cross-file taint analysis, secret detection with live validation, SCA/CVE, IaC misconfiguration, and…
xd20111/cve-2026-55200Detailed analysis of a critical pre-authentication out-of-bounds write vulnerability in libssh2 leading to remote code execution, with root cause,…
golab-arch/synaptic-sentinelThe vibe-coding security sentinel. Apache-2.0 agentic security toolkit for AI-assisted projects: 5 deterministic scouts + LLM Brain Layer (BYOK…
j4ck3lsyn-gen2/reportsCurated collection of cybersecurity research reports covering CVE analysis, exploit research, threat intelligence, and offensive security from…
securest8/npm-incident-responseScanner for the keyv/cacheable supply-chain attack: detects compromised npm packages, verifies payload hashes, and finds persistence implants in repo…
