Dev tools · alternatives · 2026

24 alternatives to Analyze the behavior of OSS for malicious intent

Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain - GitHub - ossillate-inc/packj: Packj stops Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-sou

Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Prices are shown for the 1 we have checked on their own sites, 1 of them free or with a free tier. Analyze the behavior of OSS for malicious intent launched in 2022; newer entries below may have overtaken it.

1
Socket – Secure your JavaScript supply chain▲133
Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
2022 · socket.dev · its alternatives →
2
Socket for GitHub 1.0▲91
Secure your JavaScript supply chain – block malware packages
2022 · socket.dev · its alternatives →
3
AppCanary – Keep vulnerable software off your servers▲108
aToday, we’re excited to announce that we’re going to be able to build tools that impact almost every software developer on the planet — we’re joining GitHub.
2015 · appcanary.com · its alternatives →
4
DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configs▲40
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com · its alternatives →
5
CLI that spots fake GitHub stars, risky dependencies and licence traps▲122
When I came across a study that traced 4.5 million fake GitHub stars, it confirmed a suspicion I’d had for a while: stars are noisy. The issue is they’re visible, they’re persuasive, and they still shape hiring decisions, VC term sheets, and dependency choices—but they say very little about actual quality. I wrote StarGuard to put that number in perspective based on my own methodology inspired with what they did and to fold a broader supply-chain check into one command-line run. It starts with the simplest raw input: every starred_at timestamp GitHub will give. It applies a…
2025 · github.com · its alternatives →
6
ZenVeil▲65
Copilot, Cursor, and Claude write code fast. ZenVeil catches the secrets, CVEs, and OWASP vulnerabilities they miss — in under 30 seconds — and auto-fixes with a GitHub PR. Free for public repos.
Jun 2026 · zenveil.dev · its alternatives →
7
Jetpack, a FreeBSD Jail/ZFS-based container runtime▲96
**PROTOTYPE** FreeBSD Jail/ZFS based implementation of the Application Container Specification - 3ofcoins/jetpack
2015 · github.com · its alternatives →
8
Claudoscope▲106
Browse, search & track costs across Claude Code sessions
Apr 2026 · claudoscope.com · its alternatives →
9
I built a PR listener and ruleset to detect malicious code in CI/CD▲13
I built a GitHub app that detects it in pull requests, notifies or blocks them. Alongside it, I published a Semgrep ruleset for any stage of the CI/CD. I started this after getting frustrated by all the FUD around malicious code - lots of noise, little effort to solve it. Having said that, it's still a major attack vector - a stored RCE, with the codebase itself as the sink. Feedback is appreciated. The app, PRevent - https://github.com/apiiro/PRevent The ruleset: https://github.com/apiiro/malicious-code-ruleset The research:…
2025 · github.com · its alternatives →
10
Error return traces for Go, inspired by Zig▲133
An alternative to stack traces for your Go errors. Contribute to bracesdev/errtrace development by creating an account on GitHub.
2023 · github.com · its alternatives →
11
I built a tool for policy driven vetting of open source packages▲7
Linux Foundation survey says 70-90% of modern software constitute OSS code. Yet we are stuck with tools that scan only for vulnerabilities in 3rd party libraries and that too with high degree of false positives. I built `vet` for policy and data driven analysis of 3rd party packages that goes beyond only vulnerability and allows codifying organisational policies related to OSS consumption. https://github.com/safedep/vet Looking forward to feedback and suggestions from HN :)
2023 · github.com · its alternatives →
12
I built a tool to un-dumb Claude Code's CLI output (Local Log Viewer)▲69
Hi HN, I built this because I got tired of the Claude Code CLI hiding details from me. Recent updates have replaced critical output with summaries like "Read 3 files" or "Edited 2 files". To see what actually happened, I was forced to use `--verbose`, which floods the terminal with unreadable JSON and system prompts. I wanted a middle ground: *Full observability without the noise.* `claude-devtools` is a local Electron app that tails the session logs in `~/.claude/` to reconstruct the execution trace in real-time. *Unlike wrappers, it solves the visibility gap in your native…
Feb 2026 · github.com · its alternatives →
13
A simple, highly commented, rootkit which attacks GCC and Python▲94
2014 · github.com · its alternatives →
14
An open source access logs analytics script to block bot attacks▲37
This is a small PoC Python project for web server access logs analyzing to classify and dynamically block bad bots, such as L7 (application-level) DDoS bots, web scrappers and so on. We'll be happy to gather initial feedback on usability and features, especialy from people having good or bad experience wit bots. *Requirements* The analyzer relies on 3 Tempesta FW specific features which you still can get with other HTTP servers or accelerators: 1. JA5 client fingerprinting (https://tempesta-tech.com/knowledge-base/Traffic-Filtering-b...). This is a HTTP and TLS layers…
2025 · github.com · its alternatives →
15
SafeDep Vet▲72
GitLab CI Component that lets you seamlessly protect your pipelines from vulnerable and malicious open source dependencies. The component integrates directly into your CI/CD workflow through the GitLab CI Catalog and allows you to establish policy-driven guardrails using Common Expression Language (CEL). Key features: - Set your own opinionated security policies as code using CEL - Detect and block risky OSS components before they enter your codebase - Seamless integration as a native GitLab CI Component - Available directly in the GitLab CI Catalog Try and lets us know our thoughts!
2023 · safedep.io · its alternatives →
16
A Claude Code plugin that catch destructive Git and filesystem commands▲61
A pre-execution guard for AI coding agents. It blocks destructive Git and file system commands, plus common attempts to access sensitive files, before a tool call runs. Supports Amp Code, Antigravity CLI, Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot CLI, Grok Build, Hermes Agent, Kimi Code
Dec 2025 · github.com · its alternatives →
17
HeimWall▲34
Signal, not surveillance. See how your engineers use Cursor, Claude Code, and Copilot: catch leaked secrets, PII, and confidential data, without blocking them or reading their prompts.
Jul 2026 · heimwall.ai · its alternatives →
18
Scapefree tier, from $9.99/mo▲59
Hey HN, we've been using Claude Code daily for months, and built Scape to fix our biggest pain point: managing multiple worktrees quickly & reducing the mental load of switching between them quickly. What we built: Scape is a macOS menu bar app that sits on top of Claude Code and gives you: - One-click worktrees: click a button, get a new git worktree with a Claude session already working on it. Develop in parallel without leaving your current branch. - Toolkit: per-session actions like "Create PR", "Commit & Push", "Run & Fix Tests." Add your own with bash scripts or prompts. -…
25d ago · scape.work · its alternatives →
19
Packagr.app – a private package repository with security scanning▲43
Host private Python, Docker, NPM, Debian, and Conda packages. Private package registry with 4.5x faster installs, CVE scanning, and SSO. Up to 80% cheaper than Cloudsmith. Free tier available.
2019 · packagr.app · its alternatives →
20
I built a tool that detects bad cases of the Log4j vulnerability▲19
Free defensive Log4Shell tools. Scan logs for CVE-2021-44228 JNDI exploitation attempts (including obfuscated payloads) and check whether a Log4j version is vulnerable.
2021 · log4shell.tools · its alternatives →
21TY
Test your WireGuard connectivity and see global stats, no client needed▲43
Hi HN, Some misbehaving networks drop WireGuard packets either by accident or on purpose. Commonly the latter is done with simple DPI rules that block the handshake initiation [1], but it could be applied to other message types as well. We thought it would be great if there was tool for folks to use as a quick litmus test to see if this happening for them, without having to configure a client to send data through a random, functional WireGuard tunnel to an untrusted remote host. So we built probe.sh. How it works: - The probe.sh web app is an Elixir Phoenix app that spawns a few gen_udp…
2024 · probe.sh · its alternatives →
22
VSCan - Detect Malicious VSCode Extensions▲52
Did you know that VSCode extensions run with full access to your system—including file system, network, and credentials? Worse, dozens of malicious extensions have already made it into the marketplace, silently compromising devices. I am a security researcher and student developer who ran into this problem myself. To help tackle this, I built a 100% free tool (no login required) that scans VSCode (and Cursor/Windsurf) extensions for: - Hidden malware and obfuscated code - Dangerous permissions and API misuse - Vulnerable dependencies and suspicious network connections Users have already…
2025 · vscan.dev · its alternatives →
23
OSS sustain guard – Sustainability signals for OSS dependencies▲21
Hi HN, I made OSS Sustain Guard. After every high-profile OSS incident, I wonder about the packages I rely on right now. I can skim issues/PRs and activity on GitHub, but that doesn’t scale when you have tens or hundreds of dependencies. I built this to surface sustainability signals (maintainer redundancy, activity trends, funding links, etc.) and create awareness. It’s meant to start a respectful conversation, not to judge projects. These are signals, not truth; everything is inferred from public data (internal mirrors/private work won’t show up). Quick start: pip install…
Jan 2026 · onukura.github.io · its alternatives →
24BG
Bloodhound – Grey-box attack-path discovery in Rust/Go/C++ binaries▲5
We originally set out to solve complex debugging headaches and useless alerts caused by traditional security scanners in our own projects. Static Analysis (SAST) flagged too much noise because it couldn't verify runtime context, while Dynamic Analysis (DAST) missed internal logic bugs because it treated the app like a black box. We built a CLI tool to bridge this gap using grey box testing from a red team approach. We use internal knowledge of the codebase to guide parallel execution, allowing us to find complex or hidden logic errors and attack paths standard linters/scanners miss. The…
Dec 2025 · bloodhoundsecurity.ca · its alternatives →

Also compare

Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →