Top 9 software-composition-analysis open source projects

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

scanner detecting the use of JavaScript libraries with known vulnerabilities

🔐 Shim to easily install OWASP dependency-check-cli into Python projects

Maven plugin that integrates with a Dependency Track server to submit dependency manifests and optionally fail execution when vulnerable dependencies are found.

A light-weight app to audit and inventory large codebases for open source license compliance.

OWASP Dependency Track API client for intergration into CI/CD pipeline

ScanCode.io is a server to script and automate software composition analysis pipelines with ScanPipe pipelines. This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ Google Summer of Code, nexB and others generous sponsors!

LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: https://github.com/marketplace/lunatrace-by-lunasec/

A simple Java command-line utility to mirror the entire contents of VulnDB.