OSS Review Toolkit

OSS Review Toolkit(ORT)은 소프트웨어 구성 분석(SCA), 라이선스 준수, 취약점 관리 등을 지원하는 모듈형 오픈소스 도구 모음입니다. Analyzer, Downloader, Scanner, Advisor, Evaluator, Reporter 등 6가지 도구로 구성되어 있으며, 다양한 패키지 매니저와 취약점 데이터 제공자를 통합해 소프트웨어 공급망 리스크를 체계적으로 관리할 수 있습니다. 각 도구는 독립적으로 또는 연동하여 사용 가능하며, SPDX, CycloneDX 등 표준 SBOM 생성도 지원해 AI 개발 환경에서 라이선스 및 보안 컴플라이언스 자동화에 유용합니다.

http://oss-review-toolkit.org/ort/

#softwarecompositionanalysis #licensecompliance #vulnerabilitymanagement #sbom #opensource

When using open source software, YOU become the security supplier.

Discover how SCA scanning helps manage this responsibility and protect your applications from vulnerabilities like Log4j and XZ Utils: https://anchore.com/software-supply-chain-security/software-composition-analysis/

#SoftwareCompositionAnalysis #SCA #OpenSource

With up to 90% of applications built on open source code, SCA tools are no longer optional—they're essential.

Learn how Software Composition Analysis protects your organization from supply chain vulnerabilities: https://anchore.com/software-supply-chain-security/software-composition-analysis/

#SoftwareCompositionAnalysis #SCA

Google Releases Open Source Library for Software Composition Analysis
https://www.securityweek.com/google-releases-open-source-library-for-software-composition-analysis/

#Infosec #Security #Cybersecurity #CeptBiro #Google #OpenSourceLibrary #SoftwareCompositionAnalysis

Your CI/CD pipeline is vulnerable, but it's not your fault - Elad Pticha, Oreen Livni

https://youtu.be/3dHZ-l3XSsE

#defcon32 #security #cybersecurity #infosec #hacking #appsec #applicationsecurity #cicd #gha #github #githubactions #sca #softwarecompositionanalysis

https://stiankri.substack.com/p/manifest-confusion-in-pypi

#security #cybersecurity #websecurity #appsec #applicationsecurity #hacking #python #pypi #manifestconfusion #supplychain #dependencies #sca #softwarecompositionanalysis

⚠️ Beware of "alert fatigue" in your security processes!

Learn why integrating #SoftwareCompositionAnalysis in your CI/CD pipeline is crucial for safeguarding your software from vulnerabilities: https://bit.ly/3LnT6Ci

#InfoQ article by Lukáš Křečan

#Java #SCA #CI #CD #SecurityVulnerabilities

"Invisible npm malware – evading security checks with crafted versions" by Or Peles, JFrog Vulnerability Research Team Leader

https://jfrog.com/blog/invisible-npm-malware-evading-security-checks-with-crafted-versions/

#npm #appsec #applicationsecurity #security #cybersecurity #sca #softwarecompositionanalysis #malware #evasion #jfrog #dependencies #infosec #hacking