awesome-sca

A comprehensive list of Software Composition Analysis Tools.

Following repo contains a collection of SCA tools which can be used to analyze risks in third party components which were used as part of code. Feel free to add up any new tools.

**Note: ©️ stands for proprietary sofware, Rest belongs to Free and Open Source softwares. **

Table of Contents

• Programming Languages
• Multiple Languages
• Vulnerability Databases
• SCA Platform
• Books
• Vulnerable Apps
• References

Programming Languages

Javascript

• Retire.js

Ruby

• bundler-audit

Multiple Languages

• BlackDuck ©️ Open source software security audit
• Bytesafe ©️ Discover and manage vulnerabilities in your dependencies
• BomLens - Local-first, open source SCA and SBOM tool generating CycloneDX SBOMs and license/security risk reports across Java, Python, Node.js, Go, Ruby, PHP, Rust, .NET, Swift and C/C++. Also builds AI ML-BOMs for HuggingFace models.
• Contrast Security ©️
• Debricked ©️
• Dependancy-Check - OWASP Dependancy-check supports Java, .Net. Additional experimental support has been added for Ruby,Node.js,Python and Limited C/C++ build systems.(autoconf and cmake)
• Flexera ©️
• nexB ©️
• OpenSCA - Apache License 2.0, OpenSCA is intended for scanning the third-party component dependencies and vulnerabilities.
• Plexicus ©️ - Unifying Software Composition Analysis, secret detection, API vulnerability scanning, IaC checks, container security, SBOM generation, and more - all in a single platform
• Provenant - Fast, open-source (Apache-2.0) license, copyright, package, and SBOM scanner in Rust. Generates CycloneDX and SPDX with a complete, closed, purl-keyed dependency inventory across Rust, npm, Python, Java, Go, Ruby, PHP, .NET, and more. Static and offline (no execution of scanned code or package-manager code).
• RogueWave ©️
• Snyk ©️ continuously find and fix vulnerabilities in your depandancies. it supports JS,Java,Python,Ruby,Go,PHP,.NET,Scala etc.
• Sonatype ©️
• Veracode ©️ (formerly SourceClear) - Thirdparty component analysis for Java, Ruby, Javascript, PHP, Python, Scala, Kotlin, C/C++, Objective C, Swift, Go, and .NET
• Mend ©️ - Secure your opensource components for C#,Java,C++,.NET,PHP,Python,Ruby,Docker,nodejs,Javascript etc. (formerly WhiteSource)
• Whitehat SCA ©️

Vulnerability Databases

• Debricked Vulnerability Database
• Exploit Database
• National Vulnerability Database
• Snyk Vulnerabilitydb
• VulnDB Data Mirror
• NIST Data Mirror

SCA Platform

• Dependancy Track

Books

• Securing Open Source Libraries By Guy Podjarny

Vulnerable Apps

Javascript

• goof

Java

• java-goof

References

Articles

• Choosing a tool to track and mitigate open source security vulnerabilities