Analyze the behavior of OSS for malicious intent

What it does

Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain - GitHub - ossillate-inc/packj: Packj stops Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

• 
  Socket – Secure your JavaScript supply chain2022 · socket.dev · ▲133

  Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…

• 
  Socket for GitHub 1.02022 · socket.dev · ▲91

  Secure your JavaScript supply chain – block malware packages

• 
  AppCanary – Keep vulnerable software off your servers2015 · appcanary.com · ▲108

  aToday, we’re excited to announce that we’re going to be able to build tools that impact almost every software developer on the planet — we’re joining GitHub.

• 
  DepsGuard – One command to harden NPM/pnpm/yarn/bun/uv configsJun 2026 · github.com · ▲40

  I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…

• 
  CLI that spots fake GitHub stars, risky dependencies and licence traps2025 · github.com · ▲122

  When I came across a study that traced 4.5 million fake GitHub stars, it confirmed a suspicion I’d had for a while: stars are noisy. The issue is they’re visible, they’re persuasive, and they still shape hiring decisions, VC term sheets, and dependency choices—but they say very little about actual quality. I wrote StarGuard to put that number in perspective based on my own methodology inspired with what they did and to fold a broader supply-chain check into one command-line run. It starts with the simplest raw input: every starred_at timestamp GitHub will give. It applies a…

• 
  ZenVeilJun 2026 · zenveil.dev · ▲65

  Copilot, Cursor, and Claude write code fast. ZenVeil catches the secrets, CVEs, and OWASP vulnerabilities they miss — in under 30 seconds — and auto-fixes with a GitHub PR. Free for public repos.

• 
  Run full iOS 16.5 firmware on Android Devices▲508

  Contribute to oosexgang/hackios-xnu-kernel development by creating an account on GitHub.

  Dev tools · 1d ago · github.com

• 
  /dev/null▲492

  a social network for devs

  Dev tools · 4d ago · dev-null.sh

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 29d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 27d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 24d ago · openbot.run

• 
  Talanoa▲346

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 22d ago · talanoa.email

• 
  VEED.IO▲1,623

  Simple online video editing

  Growth · 2022 · veed.io

• 
  Notion AI (Alpha)▲1,483

  Meet your new partner in thought

  AI · 2022 · app.notion.com

• 
  Rewind▲1,420

  The search engine for your life

  AI · 2022 · rewind.ai

• 
  Trading cards made with e-ink displays▲1,149

  I made a thing! In 2014, I was holding a stack of iPhones and thought to myself: "Hey, if I had each phone display a playing card, I could click a button and they'd shuffle themselves" I pared that idea all the way down to this: trading cards made of e-ink displays. Right now, each card costs me about $20 each, but with only a bit more scale, I think I can get that down to $10. In doing this project, I learned how to design electronics and circuit boards. I learned Rust and wrote my first driver, I upped my CAD skills, 3D printed, and did my first resin casting. I generated the images on the…

  Dev tools · 2022 · wyldcard.io

• 
  Taplio▲1,004

  The all-in-one tool to grow your personal brand on LinkedIn

  Growth · 2022 · taplio.com

• 
  BeforeSunset▲915

  Catch beautiful sights, finish your work before sunset

  Work · 2022