sdc-check
Small tool to inform you about potential risks in your project dependencies list: - Lock file is not safe (lockfile-is-not-safe): During the development process a malicious actor could replace URLs in a lock file to package with malicious code (it is especially dangerous because it is hard to catch in PR review) - The newest package version is too new (package-is-too-new): A new version of a package could be vulnerable. It might be safer to wait X days before upgrading to the new version and let the community test it - Installation Script (install-scripts): An attacker can use installation scripts to run commands that perform malicious acts through the package installation step - Obfuscated code (obfuscated-code): A package contains obfuscated code which may point to an attempt of hiding potentially malicious code - A package has OS scripts (has-os-scripts): An attacker can use .bat/.sh scripts to execute malicious actions (downloading and launching mining apps, etc) - A package script has shell commands (dangerous-shell-commands): Package script could have potentially dangerous commands to perform malicious actions (curl, wget, chmod, cacls, etc) - The newest package version is released after
FEATURES
ALTERNATIVES
A honeypot trap for Symfony2 forms to reduce spam submissions.
Mitigate security concerns of Dependency Confusion supply chain security risks.
Websecurify provides efficient ways to protect organizations with sophisticated technology and expert consultancy.
WackoPicko is a vulnerable website with known vulnerabilities, now available as a Docker image and included in the OWASP Broken Web Applications Project.
A tool that safely installs packages with npm/yarn by auditing them as part of your install process.
Application monitoring and security platform that provides runtime visibility, threat detection, and automated response capabilities for application-layer security
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Mandos Brief Newsletter
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.
Kriptos
An AI-driven data classification and governance platform that automatically discovers, analyzes, and labels sensitive information while providing risk management and compliance capabilities.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.