AppSecNews

SCA

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

2 tools match

Active Supply Chain Security Clear all

  • Crash Override

    Crash Override

    SCA

    A supply chain platform built around build-time artifact marking, linking running workloads back to the source code, pipeline and people that produced them.

    Commercial
    Emerging

  • Socket

    Socket

    SCA

    Analyzes what a package actually does, including install scripts, network and filesystem access and obfuscated code, to catch supply chain attacks that advisory based scanners never see.

    Open source and commercial
    Growing

  • Crash Override

    Crash Override

    A supply chain platform built around build-time artifact marking, linking running workloads back to the source code, pipeline and people that produced them.

    Commercial Emerging
    SCA

  • Socket

    Socket

    Analyzes what a package actually does, including install scripts, network and filesystem access and obfuscated code, to catch supply chain attacks that advisory based scanners never see.

    Open source and commercial Growing
    SCA
Tick up to 4 tools above.