Topics / #supply-chain-security

Supply-chain-security projects on GitHub

Tools that secure software supply chains by verifying artifacts and flagging risky dependencies.

As of , the most-starred Supply-chain-security projects on GitHub are distroless (23.1K stars), SkillSpector (20.4K stars) and semgrep (17.1K stars). GitHub.Locker tracks 17 Supply-chain-security repositories with 126.9K stars combined. The fastest-growing on October 16 was SkillSpector, with +73 stars in a day.

17Projects
126.9KStars in total
+169Stars in a day
Browse in the catalog →github.com/topics/supply-chain-security ↗

Hot right now

Most stars gained in a day · Oct 16

+73

SkillSpector

NVIDIA/SkillSpector · ★ 20.4K

SkillSpector is a security scanner for AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, and MCP) that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before you install a skill.

+26

nono

nolabs-ai/nono · ★ 4.5K

nono is a zero-setup, zero-latency sandbox that runs AI coding agents (Claude Code, Codex, OpenCode, etc.) with least-privilege access, so they can't touch your SSH keys, cloud credentials, or the rest of your disk by default.

+18

artifactproof

MaxHu-xuan/artifactproof · ★ 858

ArtifactProof is an offline, local command-line tool that hashes a final PPTX with SHA-256, runs basic structural checks, and binds caller-supplied QA evidence into a tamper-evident HMAC-SHA256 receipt, so you can reverify before delivery or after receipt that nothing was swapped.

+15

semgrep

semgrep/semgrep · ★ 17.1K

Semgrep is a fast, open-source static analysis tool that scans source code to find bugs, security issues, and enforce coding standards using rules that look like ordinary code rather than abstract syntax trees or regex.

The all-time top

17 projects · by stars

  1. #1 · GoogleContainerTools/distroless

    distroless

    A set of minimal container base images that contain only your application and its runtime dependencies — no package managers, shells or other programs you would expect in a normal Linux distribution.

    23.1K
  2. #2 · NVIDIA/SkillSpector

    SkillSpector

    SkillSpector is a security scanner for AI agent skills (used by Claude Code, Codex CLI, Gemini CLI, and MCP) that detects vulnerabilities, malicious patterns, prompt injection, data exfiltration, and supply-chain risks before you install a skill.

    20.4K
  3. #3 · semgrep/semgrep

    semgrep

    Semgrep is a fast, open-source static analysis tool that scans source code to find bugs, security issues, and enforce coding standards using rules that look like ordinary code rather than abstract syntax trees or regex.

    17.1K
  1. 4

    grype

    13Kanchore/grype · Go

    Grype is a command-line vulnerability scanner that checks container images, filesystems, and SBOMs for known security vulnerabilities.

  2. 5

    xray

    11.8Kchaitin/xray · Vue

    xray is a security assessment tool built by Chaitin for scanning common web vulnerabilities and running custom PoCs against targets.

  3. 6

    osv-scanner

    11.2Kgoogle/osv-scanner · Go

    OSV-Scanner is Google's open-source command-line vulnerability scanner: it checks your project's dependencies against OSV.dev, an open vulnerability database, and reports which known vulnerabilities affect you.

  4. 7

    fresh-start

    6.2Knirholas/fresh-start

    This is the repository formerly known as nirholas/claude-code, the most widely forked mirror of the Claude Code source leak from 31 March 2026. The leaked source itself was stripped out after Anthropic's DMCA notice, which has not been retracted, so the repo now just explains what happened.

  5. 8

    awesome-agent-skills

    5.2Klibukai/awesome-agent-skills

    This is a curated Chinese-language guide to Agent Skills: a quickstart to the open Skill spec, a catalog of official docs and tutorials, a list of recommended skills grouped by category, and guidance on building and security-reviewing your own skills.

  6. 9

    bumblebee

    5.1Kperplexityai/bumblebee · Go

    Bumblebee is a read-only inventory collector that scans macOS and Linux developer machines for package, extension, and developer-tool metadata, so responders can quickly check if a machine matches a known supply-chain compromise advisory.

  7. 10

    nono

    4.5Knolabs-ai/nono · Rust

    nono is a zero-setup, zero-latency sandbox that runs AI coding agents (Claude Code, Codex, OpenCode, etc.) with least-privilege access, so they can't touch your SSH keys, cloud credentials, or the rest of your disk by default.

  8. 11

    raptor

    3.9Kgadievron/raptor · Python

    RAPTOR turns a Claude Code session into an offensive/defensive security agent: Claude.md rules, sub-agents and skills orchestrate tools like radare2, Frida, Z3 and CodeQL for binary reverse-engineering, exploit-feasibility research, and software supply-chain (SCA) analysis.

  9. 12

    npmx.dev

    3.6Knpmx-dev/npmx.dev · TypeScript

    npmx.dev is a fast, modern browser for the npm registry that gives you a quicker, more informative UI for looking up packages, users, and organizations without replacing the registry itself.

  10. 13

    artifactproof

    858MaxHu-xuan/artifactproof · Python

    ArtifactProof is an offline, local command-line tool that hashes a final PPTX with SHA-256, runs basic structural checks, and binds caller-supplied QA evidence into a tamper-evident HMAC-SHA256 receipt, so you can reverify before delivery or after receipt that nothing was swapped.

  11. 14

    awesome-agent-skills-security

    260LLMSecurity/awesome-agent-skills-security

    A curated, awesome-list style collection of research papers, standards, frameworks, and benchmarks about securing AI agent tool use and the emerging 'agent skills' ecosystem — covering attacks like prompt injection and tool poisoning as well as defenses like sandboxing and permission control.

  12. 15

    bashka

    244dmtrKovalenko/bashka · Rust

    bashka is a drop-in safety guard for the curl | bash install pattern: it parses the incoming install script, scores it against many checks, and follows forwarded scripts so every layer gets analyzed.

  13. 16

    vet

    181laravel/vet · PHP

    Laravel Vet is a dependency audit for PHP: it shows you the code a composer update is about to write into your vendor/ directory and records the packages you trust in a vet.json file, so each next update only asks about what changed.

  14. 17

    Airsec

    150bas3line/Airsec · TypeScript

    Airsec is a CLI tool that drives a coding agent you already have installed (Claude Code, Codex, OpenCode, Command Code) through a structured, multi-pass security audit of your code, then turns the findings into an actionable report.

Often tagged together