ReversingLabs Offers Free Spectra Assure Community for Open-Source Supply-Chain Security
Summary
ReversingLabs describes Spectra Assure Community, a free tool for assessing open-source package risks, including malware, vulnerabilities, secrets, and tampering, with integrations for development workflows.
Key points
- The tool assesses software across vulnerabilities, hardening, exposed secrets, malware, tampering, and supply-chain integrity.
- It is designed to integrate with IDEs, pre-commit checks, CI/CD pipelines, and artifact storage.
- The article says Community is free, while Community+ offers higher data-access volumes and added automation capabilities.
- Supported ecosystems listed include npm, PyPI, RubyGems, and NuGet.
- ReversingLabs cites its 2026 report as documenting a 73% year-over-year increase in malicious open-source packages and more than 10,000 malicious packages on npm.
- The article highlights supply-chain threats including maintainer account takeovers, exposed publishing credentials, malicious updates, and dependency hijacking.
Article Details
- Event Type
- ReversingLabs introduced Spectra Assure Community, a free software supply chain security product for developers, maintainers, contributors, and AppSec teams.
- Impact
- The product is intended to help users assess open-source package risks through binary analysis, malware detection, vulnerability and tampering checks, and workflow integrations. ReversingLabs reports a 73 percent year-over-year increase in malicious open-source packages and more than 10,000 malicious packages distributed exclusively on npm.