Runs on-prem

Know what’s in your code - and what’s risky.

Every open-source package in your GitHub repos. Vulnerabilities ranked by real exploit risk. Malware and license violations flagged.

Request access Book a demo

Search packages, malware ID, CVE or GHSA IDs...

Total Repositories

12 no alerts36 with alerts

Active Malware

affected packagesaction required

Active Vulnerabilities

1,204

418 high-risk3 actively exploited

Total Dependencies

6,310

131 avg/repo7 license violations

Security Score

moderate

AI Components

across 14 repos6 risks

Vulnerability Distribution

Breakdown by severity level

Medium51%
High34%
Low12%
Critical3%

Ecosystem Distribution

Top 5 technology stack distribution

npm72%
PyPI16%
Go7%
Maven3%
GitHub Actions2%

License Distribution

Top 5 license distribution

MIT64%
Apache-2.018%
BSD-3-Clause7%
ISC5%
BSD-2-Clause2%

Supported ecosystems

npm
PyPI
Maven
Go
GitHub Actions
and more

Where risk enters

Most of the code you ship is code you didn’t write.

Repositories
Developers & AI agentsSoon
Pull requestsSoon
CI pipelinesSoon

npm
PyPI
Maven
Go
GitHub Actions
and more

Ranked by risk
Slack alerts

One place for every dependency

Dependency Visibility

Every package in every repo, riskiest first.

VulnerabilitiesMalwareDependenciesAI BOM

Package	Severity	CVE/GHSA ID	Installed Version	Fixed Version	Ecosystem	Exploit Risk
org.apache.logging.log4j:log4j-core	Critical	CVE-2021-44228	2.14.1	2.15.0	Maven	100%
golang.org/x/net	Medium	CVE-2023-45288	v0.17.0	v0.23.0	Go	92%
lodash	High	CVE-2021-23337	4.17.20	4.17.21	npm	21%
requests	Medium	CVE-2024-47081	2.31.0	2.32.4	PyPI	1%

Package Name	Malware ID	Ecosystem	Installed Version	Fixed Version	Affected Repos	Published
react-nodejs	MAL-2026-17294	npm	19.3.0	No fix	2	29-09-2026
spo365-graph	MAL-2026-17421	PyPI	1.1.0	No fix	1	01-10-2026
github.com/BufferZoneCorp/log-core	MAL-2026-3628	Go	v0.1.0	No fix	1	13-05-2026

Package	Ecosystem	Installed Version	License
example-pdf-render	Maven	4.2.0	GPL-3.0
actions/checkout	GitHub Actions	v4	MIT
lodash	npm	4.17.20	MIT
requests	PyPI	2.31.0	Apache-2.0

Component	Category	Provider	Ecosystem	Installed Version	Severity	Exploit Risk
example-llm-gateway	Framework	Example AI	PyPI	2.1.0	High	64%
demo-agent-core	Framework	Demo Labs	PyPI	0.3.7	Critical	43%
sample-mcp-server	Framework	MCP	npm	1.4.2	Medium	12%
demo-embeddings	Library	Demo Labs	PyPI	5.2.0	Low	3%

Coming soon

Supply Chain Firewall

Blocks risky packages at install time on laptops, AI agents and CI.

Coming soon

PR Review

Security review of every pull request.

How it works

Deploy on-prem
Runs on your own servers or private cloud.
Connect GitHub
Choose the repositories to monitor.
Fix what matters first
The riskiest issues come first, with Slack alerts.

Common questions

Is SafePack a SaaS product?

No. SafePack runs on-prem, in your own infrastructure.

Where does the risk data come from?

From OSV.dev, the open database of vulnerabilities and malicious packages. Exploit risk comes from FIRST EPSS, and anything on the CISA KEV list of actively exploited vulnerabilities shows as 100% exploit risk.

What data leaves our infrastructure?

Your source code is never copied. Only package names and versions are checked against public databases. Findings stay in your own database and any Slack channel you connect.

What access does SafePack need to GitHub?

Read access to the repositories you choose.

Which ecosystems are supported?

npm, PyPI, Maven, Go, GitHub Actions and more.

See what’s in your code.