Software Supply Chain Security API
Independent SBOM and dependency checks for exact package versions: OSV advisory ranges, CISA KEV exposure, open-source licence policy, and publicly documented malicious-package advisories.
Parse a CycloneDX or SPDX SBOM, or a component list, and classify each exact package version against OSV advisories as affected, unaffected, or unknown. A similar package name is not a match.
Summarise affected, unaffected, and unknown OSV advisory counts for each exact dependency version. No risk score is calculated.
Compare exact dependency versions with OSV advisories and the CISA Known Exploited Vulnerabilities catalog. A KEV entry is reported only when that CVE applies to the same package and version range.
Read licence identifiers declared in the SBOM or published by npm, PyPI, crates.io, or RubyGems, then compare them with the caller allow and deny policy. Missing identifiers are not treated as compatible.
Look for OSV malicious-package advisories that name the same ecosystem and package. No advisory does not mean the package is free of malware.
Combine exact-version OSV matches, CISA KEV exposure, licence policy, and malicious-package advisories into one release report. The report never approves a release.