Dev tools · alternatives · 2026
24 alternatives to Trusty – Dependency Software Supply Chain Security
Trusty - Search for an open source package to understand its trustworthiness based on activity, provenance, and more. Brought to you by the founders of projects such as Kubernetes and Sigstore. Hey, Luke here the CTO of stacklok. This is an early experimental preview of Trusty. We use statistical analysis to observe millions of packages and found that Malware typically follows certain patterns. We found this tool really useful to help understand the packages we our pulling into our software and wanted to share it with others. It's still early in and we have a lot more features that will be…
Trusty is a search tool that helps developers assess the trustworthiness of open source packages by analyzing activity, provenance, and other characteristics. It uses statistical analysis across millions of packages to… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes. Trusty – Dependency Software Supply Chain Security launched in 2023; newer entries below may have overtaken it.
- 1
TRUST – Coding Rust like it's 1989. Contribute to wojtczyk/trust development by creating an account on GitHub.
May 2026 · github.com · its alternatives →
- 2
Monitor NuGet and NPM packages in your repositories
2021 · its alternatives →
- 3
A curated database of insecure Python packages. Contribute to pyupio/safety-db development by creating an account on GitHub.
2016 · github.com · its alternatives →
- 4
- 5
- 6
Self-hosted AI agent that connects 1000+ apps on Vercel
May 2026 · github.com · its alternatives →
- 7
SonarQube provides advanced SAST, SCA & secrets detection to secure your SDLC. Scan 40+ languages for vulnerabilities. Start your free trial today.
2016 · dependencyci.com · its alternatives →
- 8
- 9
Trace-AI▲146Know What You Ship. Secure What You Depend On.
Oct 2025 · trace-ai.dev · its alternatives →
- 10
Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
2022 · socket.dev · its alternatives →
- 11
- 12
deptry 0.14.0 was just released, bringing significant speed improvements: It is now up to 10 times faster than the previous release! For those unfamiliar with deptry; deptry is a command line tool to check for issues with dependencies in a Python project, such as unused or missing dependencies. GitHub: https://github.com/fpgmaas/deptry For some benchmarks of the new release, see the release notes: https://github.com/fpgmaas/deptry/releases/tag/0.14.0 The performance improvement was achieved by leveraging Rust to parse the AST and extract…
2024 · github.com · its alternatives →
- 13
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com · its alternatives →
- 14
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
2025 · github.com · its alternatives →
- 15
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com · its alternatives →
- 16
Host private Python, Docker, NPM, Debian, and Conda packages. Private package registry with 4.5x faster installs, CVE scanning, and SSO. Up to 80% cheaper than Cloudsmith. Free tier available.
2019 · packagr.app · its alternatives →
- 17
Secure your JavaScript supply chain – block malware packages
2022 · socket.dev · its alternatives →
- 18PD
2021 · pickbetterpack.com · its alternatives →
- 19
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com · its alternatives →
- 20
GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.
2017 · dependabot.com · its alternatives →
- 21
- 22
- 23
Stop building and managing CI/CD pipelines and toolchains
2022 · trustacks.com · its alternatives →
- 24
Bytesafe▲66A better way to control your software supply chain
2021 · bytesafe.dev · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →