Parameter Supply Chain

Parameter Supply Chain is an AI-driven software composition analysis tool that identifies and manages dependency risks across software projects. It uses automated agents to resolve full dependency graphs from repository lockfiles, covering both direct and transitive packages across multiple ecosystems. How it works: - Resolve: Agents connect to a repository and parse lockfiles to build a complete dependency graph, capturing every direct and transitive package across all supported ecosystems. - Inspect: Each package is checked against malware intelligence databases, known vulnerability advisories, and license policies. Reachability analysis determines whether application code actually calls into the vulnerable code path, filtering out unreachable findings. - Fix: Each confirmed finding includes the safe version and an automated pull request to bump the dependency, enabling one-click remediation followed by an immediate re-scan. Key capabilities: - Reachability analysis: Traces whether application code can actually reach a vulnerable function, reducing noise from CVE dumps on unreachable transitive dependencies. - Malware detection: Inspects install scripts, obfuscated payloads, and typosquatted packages before they execute in CI pipelines. - SBOM generation: Produces signed CycloneDX and SPDX software bills of materials that regenerate on every push, keeping attestations current with what is actually shipped. - Automated remediation: Generates pull requests with safe version bumps for every confirmed finding. Supported ecosystems: - JavaScript/TypeScript: npm, Yarn, pnpm, Bun - Python: pip, Poetry, uv - Go: Go modules and go.sum - Java/Kotlin: Maven and Gradle - Containers: Dockerfiles (base images and OS packages) - Rust, Ruby, PHP: Cargo, Bundler, Composer