#1Dependency scanning, SBOM generation, package integrity, and supply chain risk tools.
Kitploit recommended
tokyoneon/arcaneArcane is a simple script designed to backdoor iOS packages (iphone-arm) and create the necessary resources for APT repositories.
owasp/software-component-verification-standardSoftware Component Verification Standard (SCVS)
santhreal/keyhogOpen-source secret scanner in Rust
nuguardai/nuguardopensource repo for validating agentic AI applications: redteam, behavior, supply-chain, static analysis
traceforce/mcp-xrayUnified security scanner for MCP servers with config, pentest, and repo-scan modes. Generates SARIF reports for CI/CD integration, detects secrets,…
koadt/oss-oopssec-storeSecurity training for the apps you actually ship. Open your browser and start hacking.
ohaswin/pyscanpython dependency vulnerability scanner, written in Rust.
dhiyaneshgeek/my-presentation-slidesCollection's of Tech Talk that are presented by me :)
tindersec/gh-workflow-auditorScript to audit GitHub Action Workflow files for potential vulnerabilities.
kpcyrd/sh4d0wupSigning-key abuse and update exploitation framework
matheuzsecurity/elfdoor-gccLD_PRELOAD-based tool that hijacks gcc to inject malicious code into binaries during linking, enabling stealthy backdoor deployment without source…
opensourcemalware/polinriderTechnical dossier on the DPRK-linked PolinRider supply-chain attack, documenting obfuscated JS payload injection, git history manipulation, C2…
aurva-io/aiostackAI runtime inventory: discover shadow AI, trace LLM calls
mubix/ai-ctfLocal AI Capture-the-Flag platform with guided lessons on prompt injection, tool-call abuse, and OSINT against six simulated chatbot personas.
wolfssl/wolfcoseA fast, portable, and lightweight COSE + CBOR implementation for embedded systems. Supports PQC, FIPS 140-3, DO-178, and MISRA C. Powered by wolfSSL.
agentguard-ai/tealtigerPowerful protection for AI agents - Open-source security and cost tracking for AI applications
fazmin/cve-intelLocal security intelligence for CVE triage - 39 data sources and 36 tools, risk scores and an MCP server for AI agents, all in native Rust. Private…
jfrog/text4shell-toolsDetect and patch vulnerable Apache Commons Text in Java JAR/WAR artifacts; fingerprint classes and scan bytecode for CVE-2022-42889 (Text4Shell) call…
