Open-Source Cybersecurity Tools: Supply Chain Security
← Back to Open-Source Cybersecurity Tools Hub | Full Open Source Catalog | Main Atlas
This category contains 7 documented tools. It focuses on capabilities used for dependency provenance controls, build pipeline trust, and artifact verification. Use this section when building shortlists, comparing operational tradeoffs, and mapping controls to detection/response ownership.
Category Evaluation Checklist
- Coverage depth against your highest-priority threats and compliance obligations.
- Operational overhead for deployment, tuning, and long-term maintenance.
- Signal quality versus analyst workload and false-positive pressure.
- Integration fit with SIEM, ticketing, identity, cloud, and engineering workflows.
- Governance readiness including auditability, ownership clarity, and change control.
Jump by Name
Letter C
This letter section contains 1 tools.
Confusion checker
- Website: https://github.com/sonatype-nexus-community/repo-diff
- Model: Open Source
- Category: Supply Chain Security
- Source Lists: Awesome Cybersecurity Blue Team
What it does: Confusion checker is used in supply chain security programs to support dependency provenance controls, build pipeline trust, and artifact verification. Source summaries describe it as: Script to check if you have artifacts containing the same name between your repositories.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Cybersecurity Blue Team > DevSecOps > Dependency confusion.
Letter D
This letter section contains 1 tools.
Dependency Combobulator
- Website: https://github.com/apiiro/combobulator
- Model: Open Source
- Category: Supply Chain Security
- Source Lists: Awesome Cybersecurity Blue Team
What it does: Dependency Combobulator is used in supply chain security programs to support dependency provenance controls, build pipeline trust, and artifact verification. Source summaries describe it as: Open source, modular and extensible framework to detect and prevent dependency confusion leakage and potential attacks.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Cybersecurity Blue Team > DevSecOps > Dependency confusion.
Letter H
This letter section contains 1 tools.
Helm GPG (GnuPG) Plugin
- Website: https://github.com/technosophos/helm-gpg
- Model: Open Source
- Category: Supply Chain Security
- Source Lists: Awesome Cybersecurity Blue Team
What it does: Helm GPG (GnuPG) Plugin is used in supply chain security programs to support dependency provenance controls, build pipeline trust, and artifact verification. Source summaries describe it as: Chart signing and verification with GnuPG for Helm.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Cybersecurity Blue Team > DevSecOps > Supply chain security.
Letter I
This letter section contains 1 tools.
in-toto
- Website: https://in-toto.io/
- Model: Open Source
- Category: Supply Chain Security
- Source Lists: Awesome Cybersecurity Blue Team
What it does: in-toto is used in supply chain security programs to support dependency provenance controls, build pipeline trust, and artifact verification. Source summaries describe it as: Framework to secure the integrity of software supply chains.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Cybersecurity Blue Team > DevSecOps > Supply chain security.
Letter N
This letter section contains 1 tools.
Notary
- Website: https://github.com/theupdateframework/notary
- Model: Open Source
- Category: Supply Chain Security
- Source Lists: Awesome Cybersecurity Blue Team
What it does: Notary is used in supply chain security programs to support dependency provenance controls, build pipeline trust, and artifact verification. Source summaries describe it as: Aims to make the internet more secure by making it easy for people to publish and verify content.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Cybersecurity Blue Team > DevSecOps > Supply chain security.
Letter P
This letter section contains 1 tools.
Preflight
- Website: https://github.com/spectralops/preflight
- Model: Open Source
- Category: Supply Chain Security
- Source Lists: Awesome Security
What it does: Preflight is used in supply chain security programs to support dependency provenance controls, build pipeline trust, and artifact verification. Source summaries describe it as: helps you verify scripts and executables to mitigate supply chain attacks in your CI and other systems.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Security > DevOps.
Letter S
This letter section contains 1 tools.
snync
- Website: https://github.com/snyk-labs/snync
- Model: Open Source
- Category: Supply Chain Security
- Source Lists: Awesome Cybersecurity Blue Team
What it does: snync is used in supply chain security programs to support dependency provenance controls, build pipeline trust, and artifact verification. Source summaries describe it as: Prevent and detect if you're vulnerable to dependency confusion supply chain security attacks.
Operational value: Security teams commonly use this capability to improve consistency between detection, investigation, and response decisions, especially when alerts, evidence collection, and triage ownership are distributed across multiple teams.
Typical deployment pattern: Implementations usually start with scoped pilot coverage, baseline logging/telemetry validation, and explicit runbook mapping so analysts understand when to escalate, contain, or defer.
Selection considerations: As an open-source option, teams usually evaluate maintainer activity, release cadence, and community response quality. Related source context: Awesome Cybersecurity Blue Team > DevSecOps > Dependency confusion.