perseus-supply-chain

To scan dependencies for supply chain risks, trigger manifest discovery to enumerate dependencies across JavaScript, Go, Python, Rust, Java, Ruby, and C# projects. The analysis applies CVE checks, typosquatting detection, license review, and lockfile integrity validation to produce a structured deliverable with remediation guidance.

Supported manifests for dependency confusion and CVE analysis include package.json, go.mod, pyproject.toml, and pom.xml. The tool discovers these files across JavaScript, Go, Python, Rust, Java, Ruby, and C# projects to enumerate dependencies and surface supply chain risks.

Supply chain risk analysis does check for typosquatting and license compliance issues. It identifies and prioritizes these risks alongside CVEs and dependency confusion to prevent compromised code, generating a deliverable with mitigation guidance for both engineers and executives.

Lockfile integrity validation works during dependency risk assessment by checking lockfiles to ensure reproducible builds and verify that resolved dependencies match expected states. This process surfaces discrepancies that could indicate supply chain compromise or unauthorized package modifications.

You can use this supply chain tool with Python and Rust projects. It discovers manifests like pyproject.toml for Python and applies cross-language CVE checks, typosquatting detection, and license review to enumerate dependencies and surface risks across both ecosystems.