#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
24owais/threat-intel-cve-2024-3094Threat intelligence report analyzing the xz-utils backdoor vulnerability (CVE-2024-3094)
felipecruz91/node-ip-vexSample project that uses VEX to supress CVE-2024-29415.
dannyendortest/node-prompt-hereDeliberately vulnerable Node.js demo target for CVE-2020-7602, used to showcase automated dependency vulnerability detection and one-click PR-based…
dannyendortest/ollama-consumerDemo consumer for ollama v0.5.0 (vulnerable range for CVE-2024-12886) — endorctl scan target
pvharmo2/gha-lab-2f775f277cAuthorized lab reproduction of CVE-2025-47928 (spotipy-dev/spotipy pull_request_target secrets exfiltration) — snapshot at vulnerable commit 4f5759d
soliantconsulting/cve-2025-46295-fix-fmsAutomated script suite to detect and remediate CVE-2025-46295 by replacing vulnerable Apache Commons JARs in FileMaker Server installations with…
sassoftware/jacksonThis repository provides a comprehensive security remediation of denial-of-service and allocation of resources without limits or throttling security…
berkley4/icu-74-debianDebian build files for icu 74.2 with a patch to fix CVE-2025-5222
knqyf263/aqua-checksumsMonitors cryptographic integrity of container images, releases, and Git tags for supply chain security, verifying Sigstore cosign signatures with…
ahmedreda38/cve-2025-47273-pocCVE-2025-47273 is a high-severity path traversal vulnerability in the setuptools library ,specifically version 78.1.0 .
rohitberiwala/nodejs-tar-symlink-exploit-cve-2026-29786Technical analysis and Proof-of-Concept (PoC) for a critical Path Traversal vulnerability via Symlink manipulation in the Node.js 'tar' package…
jvr2022/cve-2026-29786Proof-of-concept demonstrating a hardlink path traversal in the tar npm package, allowing overwrite of files outside the extraction directory via…
alielkhatteb/cve-2025-47273-pocCVE-2025-47273 — setuptools path traversal PoC
renat0z3r0/notepadpp-supply-chain-iocsIoCs and detection rules for the Notepad++ supply chain attack (CVE-2025-15556) — Lotus Blossom APT, June–December 2025. Includes Falcon LogScale…
scriptzteam/node-ipc-malware-protestware-cve-2022-23812node-ipc is malware / protestware!
gouldnicholas/cve-2026-4660-pocPoC for CVE-2026-4660: arbitrary file read via git checkout in hashicorp/go-getter
bhimsekhar/vulnerable-java-appSpring Boot app with log4j 2.14.1 (CVE-2021-44228) — VulnFix agent test target
reefspek/cocoapods-rce_cve-2024-38366CocoaPods RCE Vulnerability CVE-2024-38366
