Skip to content

depshieldx

A safer wrapper around package install and scan workflows -- for PyPI, npm/yarn/pnpm, Cargo/crates.io, Go modules, Maven/Maven Central, NuGet/NuGet.org, Pub/pub.dev, RubyGems/rubygems.org, and Composer/Packagist.

Get Started View on GitHub

PyPI version

Before installing, depshieldx resolves the full package set, checks provenance for the exact artifacts that would be used, queries four vulnerability sources for the resolved versions, and can optionally run a deeper Docker + Trivy validation path with real behavioral tracing of the sandboxed install. Every completed install or scan also writes signed local receipt JSON files.

What it does

  • Full dependency resolution

    Resolves the complete dependency set before installation, across all nine supported ecosystems.

  • Provenance checks

    Verifies the exact release artifacts that would be used -- cryptographic Sigstore verification on PyPI/npm/Maven, checksum + structural checks elsewhere.

    Provenance & Attestations

  • Four vulnerability sources

    Queries OSV, GitHub Advisories, CISA KEV, and deps.dev concurrently for every resolved package version.

    Vulnerability Sources

  • Deep mode

    Docker + Trivy scanning with real syscall-level behavioral tracing of the sandboxed install, for every supported ecosystem.

    Modes

  • Signed receipts

    Every completed install or scan writes a signed local receipt JSON file you can list, verify, and inspect later.

    Receipts

  • Nine ecosystems

    PyPI, npm/yarn/pnpm, Cargo, Go modules, Maven, NuGet, Pub, RubyGems, and Composer, each with ecosystem-specific provenance and tracing support.

    Ecosystems overview

Quick start

Install with the default (fast) path:

depshieldx install requests

Run the deeper Docker + Trivy validation path:

depshieldx install requests --deep

Scan without installing:

depshieldx scan requests

See Quick Start for more, including lockfiles, pyproject.toml, and other ecosystems.