safedep/vet
Protect against malicious open source packages 🤖 observed · 2026-08-28
Health v2 · maintenance only
93/100
- Activity 99
- Release rhythm 85
- Longevity 95
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: 7
- age_days: 1342
- days_rel: 20
- days_push: 8
- n_releases_24m: 70
Adoption not part of the score
1103 stars · 111 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded
vet is an open-source CLI tool for software composition analysis that scans open-source dependencies for malicious packages and vulnerabilities, and enforces policy-as-code using CEL expressions. It integrates into CI/CD pipelines as a zero-config security guardrail and supports ecosystems like npm, PyPI, and RubyGems.
Use cases
- scan npm and pypi dependencies for malicious packages before shipping
- enforce license and vulnerability policy as code in CI
- generate an SBOM for my repository
- block risky open source packages in pull requests
- cut down CVE noise by checking actual code usage of dependencies
- audit dependencies for supply chain attacks like Shai-Hulud
When to choose
- you want a free, open-source SCA tool with policy-as-code enforcement in CI/CD
- you need malicious package detection across npm, PyPI, and RubyGems ecosystems
- you want SBOM generation and dependency scanning from a single CLI
When to avoid
- you need dynamic behavioral malware analysis without a SafeDep Cloud account
- you require org-wide dashboards and centralized policy management, which are paid SaaS features
Facets
cli-tool · maturity active
security vulnerability-scanning dependency-audit developer-tools ci-cd security developer-tools windows cli sca sbom policy-as-code malicious-package-detection software-supply-chain cel devops supply-chain-security linux macos docker nodejs
10 sources
- readme: https://github.com/safedep/vet · fetched 2026-08-28 · 1729c2f04898
- homepage: https://safedep.io · fetched 2026-08-29 · 95b76763f5f3
- site_page: https://docs.safedep.io/ · fetched 2026-08-29 · 6b2b88eecdc9
- site_page: https://docs.safedep.io · fetched 2026-08-29 · 6b2b88eecdc9
- site_page: https://safedep.io/about · fetched 2026-08-29 · c8ac05dbd6b0
- site_page: https://safedep.io/developer-security · fetched 2026-08-29 · 1ddf550e6a06
- site_page: https://safedep.io/pricing · fetched 2026-08-29 · eab7c57096c1
- site_page: https://safedep.io/malicious-litellm-1-82-8-analysis · fetched 2026-08-29 · 4d44e8846df6
- site_page: https://safedep.io/youtube-ad-fake-tradingview-macos-stealer · fetched 2026-08-29 · ae7361afad35
- site_page: https://safedep.io/faq · fetched 2026-08-29 · 2792d62596a8
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| safedep/vet | main | 93 |
For agents
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem