From 603bfe65a30a15822c09eba7f992fc16461eefcc Mon Sep 17 00:00:00 2001 From: James Dykstra Date: Fri, 17 Jul 2026 16:50:16 -0400 Subject: [PATCH 1/2] Add Lazaretto Scan to OSS and Dependency management --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 071e3a9..479cd55 100644 --- a/README.md +++ b/README.md @@ -137,6 +137,7 @@ Dependency security testing and analysis is very important part of discovering s | **vulncost** | [https://github.com/snyk/vulncost](https://github.com/snyk/vulncost) | Security Scanner for VS Code |![Vulncost](https://img.shields.io/github/stars/snyk/vulncost?style=for-the-badge) | | **Vulert** | [Vulert](https://Vulert.com) | Vulert secures software by detecting vulnerabilities in open-source dependencies—without accessing your code. It supports Js, PHP, Java, Python, and more | | **Dependency Combobulator** | [https://github.com/apiiro/combobulator](https://github.com/apiiro/combobulator) | Dependency-related attacks detection and prevention through heuristics and insight engine (support multiple dependency schemes) | ![Combobulator](https://img.shields.io/github/stars/apiiro/combobulator?style=for-the-badge) | +| **Lazaretto Scan** | [https://github.com/jamesdfinance-dev/lazaretto-scan-action](https://github.com/jamesdfinance-dev/lazaretto-scan-action) | GitHub Action (MIT) that scans npm packages, repos, and skills for malicious behavior via known-bad indicators plus deterministic behavioral rules; posts the verdict as a PR comment and fails the build on a malicious verdict. | ![Lazaretto](https://img.shields.io/github/stars/jamesdfinance-dev/lazaretto-scan-action?style=for-the-badge) | | **DependencyTrack** | [https://github.com/DependencyTrack/dependency-track](https://github.com/DependencyTrack/dependency-track) | Dependency security tracking platform |![DependencyTrack](https://img.shields.io/github/stars/DependencyTrack/dependency-track?style=for-the-badge) | | **DependencyCheck** | [https://github.com/jeremylong/DependencyCheck](https://github.com/jeremylong/DependencyCheck) | Simple dependency security scanner good for CI |![DependencyCheck](https://img.shields.io/github/stars/jeremylong/DependencyCheck?style=for-the-badge) | | **Retire.js** | [https://github.com/retirejs/retire.js/](https://github.com/retirejs/retire.js/) | Helps developers to detect the use of JS-library versions with known vulnerabilities |![Retire.js](https://img.shields.io/github/stars/retirejs/retire.js?style=for-the-badge) | From bf8ea440bbc420373a663ea72c69bc00385a6d6e Mon Sep 17 00:00:00 2001 From: James Dykstra Date: Wed, 22 Jul 2026 15:08:35 -0400 Subject: [PATCH 2/2] Tighten the entry and note it needs no API key Leads with what the action does and drops the trailing period to match neighbouring rows. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 479cd55..9b47996 100644 --- a/README.md +++ b/README.md @@ -137,7 +137,7 @@ Dependency security testing and analysis is very important part of discovering s | **vulncost** | [https://github.com/snyk/vulncost](https://github.com/snyk/vulncost) | Security Scanner for VS Code |![Vulncost](https://img.shields.io/github/stars/snyk/vulncost?style=for-the-badge) | | **Vulert** | [Vulert](https://Vulert.com) | Vulert secures software by detecting vulnerabilities in open-source dependencies—without accessing your code. It supports Js, PHP, Java, Python, and more | | **Dependency Combobulator** | [https://github.com/apiiro/combobulator](https://github.com/apiiro/combobulator) | Dependency-related attacks detection and prevention through heuristics and insight engine (support multiple dependency schemes) | ![Combobulator](https://img.shields.io/github/stars/apiiro/combobulator?style=for-the-badge) | -| **Lazaretto Scan** | [https://github.com/jamesdfinance-dev/lazaretto-scan-action](https://github.com/jamesdfinance-dev/lazaretto-scan-action) | GitHub Action (MIT) that scans npm packages, repos, and skills for malicious behavior via known-bad indicators plus deterministic behavioral rules; posts the verdict as a PR comment and fails the build on a malicious verdict. | ![Lazaretto](https://img.shields.io/github/stars/jamesdfinance-dev/lazaretto-scan-action?style=for-the-badge) | +| **Lazaretto Scan** | [https://github.com/jamesdfinance-dev/lazaretto-scan-action](https://github.com/jamesdfinance-dev/lazaretto-scan-action) | GitHub Action (MIT) that fails the build when a pinned dependency is known malware. Checks package-lock, yarn.lock, and pnpm-lock against published advisories with no API key, and posts the verdict as a PR comment | ![Lazaretto](https://img.shields.io/github/stars/jamesdfinance-dev/lazaretto-scan-action?style=for-the-badge) | | **DependencyTrack** | [https://github.com/DependencyTrack/dependency-track](https://github.com/DependencyTrack/dependency-track) | Dependency security tracking platform |![DependencyTrack](https://img.shields.io/github/stars/DependencyTrack/dependency-track?style=for-the-badge) | | **DependencyCheck** | [https://github.com/jeremylong/DependencyCheck](https://github.com/jeremylong/DependencyCheck) | Simple dependency security scanner good for CI |![DependencyCheck](https://img.shields.io/github/stars/jeremylong/DependencyCheck?style=for-the-badge) | | **Retire.js** | [https://github.com/retirejs/retire.js/](https://github.com/retirejs/retire.js/) | Helps developers to detect the use of JS-library versions with known vulnerabilities |![Retire.js](https://img.shields.io/github/stars/retirejs/retire.js?style=for-the-badge) |