A Guide to Software Supply Chain Security Tools
Summary
Aikido compares software supply chain security tools, covering dependency scanning, malicious package detection, artifact signing and SBOMs. The vendor-authored guide promotes Aikido alongside alternatives.
Key points
- The guide recommends evaluating threat coverage, workflow integrations, prioritization, access controls, compliance support and deployment requirements.
- Dependabot and GitLab Dependency Scanning surface known dependency vulnerabilities within their respective development workflows.
- The article describes Phylum as using heuristics and machine learning to assess open-source packages, including malware and typosquatting signals.
- Sigstore and Cosign support artifact signing and verification, including keyless signing using OIDC identities.
- Aikido says its Safe Chain tool blocks malicious dependencies at installation and that its platform combines multiple scanning modules.
- The guide recommends placing automated scans and policy-based build gates early in CI/CD pipelines.
Article Details
- Topic
- Software supply chain security tools and evaluation criteria
Vendors
AikidoOver the past year, Aikido Security detected several npm supply chain attacks, from Shai Hulud’s credential-stealing malware to S1ngularity’s dependency confusion attacks, the massive September npm outbreak, theAqua Security2. Aqua Security (Chain-Bench) ChainguardChainguard is a software supply chain security platform focused on securing container supply chains. It’s known for its hardened base container images and heavy involvement in projects like Sigstore.GitHubCan DevSecOps teams collaborate on findings directly from integrated tools like GitHub, GitLab, Jira and Slack?GitLabCan DevSecOps teams collaborate on findings directly from integrated tools like GitHub, GitLab, Jira and Slack?JFrog6. JFrog Xray Mend12. Mend (Formerly WhiteSource)ReversingLabsReversingLabs offers an advanced supply chain security platform, recently branded Spectra Assure that brings file reputation and binary analysis to the software pipeline.SnykSnyk is a DevSecOps platform that helps developers find and fix vulnerabilities in their code, open-source dependencies, containers, and cloud configs..Sonatype11. Sonatype Nexus Lifecycle Veracode7. Phylum (Now part of Veracode)
Products
Aikido SecurityOver the past year, Aikido Security detected several npm supply chain attacks, from Shai Hulud’s credential-stealing malware to S1ngularity’s dependency confusion attacks, the massive September npm outbreak, theChainguardChainguard is a software supply chain security platform focused on securing container supply chains. It’s known for its hardened base container images and heavy involvement in projects like Sigstore.Dependabot4. GitHub Dependabot GitLab Dependency ScanningGitLab Dependency Scanning: Simple CI integration, actionable findings in merge requestsJFrog XrayJFrog Xray is a software composition analysis tool. It is integrated with JFrog’s binary/package repository and CI pipelines.Mend12. Mend (Formerly WhiteSource)Nexus Lifecycle11. Sonatype Nexus Lifecycle Phylum7. Phylum (Now part of Veracode) SigstoreChainguard is a software supply chain security platform focused on securing container supply chains. It’s known for its hardened base container images and heavy involvement in projects like Sigstore.SnykSnyk is a DevSecOps platform that helps developers find and fix vulnerabilities in their code, open-source dependencies, containers, and cloud configs..Spectra AssureReversingLabs offers an advanced supply chain security platform, recently branded Spectra Assure that brings file reputation and binary analysis to the software pipeline.
Tools
Aikido Safe Chainfirst to flag new malware campaigns before they hit mainstream databases, and its open-source tool, Aikido Safe Chain, blocks malicious packages at install time, the kind of thing that stopped the npm outbreak and ShaiChain-Bench2. Aqua Security (Chain-Bench) Cosign9. Sigstore/Cosign