lunasec - LunaSec - Dependency Security Scanner that automat

项目说明

<!--
~ Copyright by LunaSec (owned by Refinery Labs, Inc)
~
~ Licensed under the Creati Attribution-ShareAlike 4.0 International
~ (the "License"); you may not use this file except in compliance with the
~ License. You may obtain a copy of the License at
~
~
~
~ See the License for the specific language go permissions and
~ limitations under the License.
~
-->

<p align="center">
<img src='docs/static/img/logo-black-text.svg' width='60%'>
</p>

LunaTrace

LunaTrace is an Open Source supply chain security and auditing tool. At its heart is a web console the tracks your projects and their dependencies, looking for and other issues. This console is provided as a SAAS (a here for free) or you can deploy it and manage it yourself.

Please see our LunaTrace documentation for more information.

Short Introduction Video

<p align="center">
<a href="
<img alt="LunaTrace Introduction Video" src=" width="70%">
</a>
</p>

Repo Structure

We're a team of Security Engineers on a mission to make awesome Open Source Application Security tooling. It all lives
in this monorepo and here's a breakdown of where e we' lives.

LunaTrace: A free alternative to services like GitHub Dependabot or Snyk that

automatically monitors for your dependencies for . It automatically integrates with GitHub Pull Requests
to notify you of new C you deploy to production. Try it out in one-click via our GitHub App.
- Status: Production ready and under acti (our primary focus).

Log4Shell CLI: A small command line utility to scan for Log4Shell. Also supports patching JAR files against

Log4Shell, scanning running processes on your system, and more. Follow our
Mitigation Guide for more context.
- Status: Production ready and used by thousands of companies. Superseded by LunaTrace.

Our Security Blog: Our ramblings to the internet. This is where we broke the news about the log4j and gave it the name Log4Shell. The blog lives in this repo under /docs/blog if you feel

like contributing!
- Status: Continuously updated and any requests for us to write about topics is encouraged.

LunaDefend: An end-to-end suite of security software built

around Tokenization designed to _proactively_ protect your sensitive data from being hacked, as well as pro an
easier path towards compliance (SOC2, GDPR, PCI-DSS, etc).
- Status: Unmaintained (but feel free to open issues).

Support

If you find yourself stuck, you're missing a feature, or you just want to clear up some confusion, then please
join our Discord Community to speak with us.

We're a small team and we're always looking for more feedback about what problems we can help solve, so we'd love if you took a moment to try out LunaTrace and, if you like it, share it with your colleagues and friends. The hardest part of our mission to build better security tools is simply getting people to realize that they exist!

Contributing

We welcome community contributions and we' the requirements for contributions here.

If you'd like to contribute ideas or feedback, you can do so by either opening a GitHub issue or speaking with us on Discord.

See Also

For more information about LunaSec including tutorials, examples, and technical information, please visit
our documentation.
For marketing information, sales, or to get in touch, visit our website:

The rest of this ReadMe explains how to work on LunaSec itself. If you simply want to use LunaSec, please see the documentation.

Contributing

Please read our contributor instructions
before forking and submitting a pull request. It's short and it's very helpful if you're going to be working on LunaSec.

Feedback

Our goal is to create a sustainable business to support LunaSec, while also building an Open Source community. If you ha on how we can improve our
approach, we would love to hear from you.

Please email us at de at lunasec dot io *or* file an issue on this repository.

Release Process

The release process will be handled automatically by our CI/CD system.

Under the hood, the release process is split up into four parts:
1. bump
1. Compile artifacts
1. Publish artifacts
1. Push tag to repository

Breaking this process up ensures that every part completes without error before moving onto the next step. This greatly reduces the event that some artifacts get published and others do not, leading to a headache of a time debugging a release.

Deployment of the releases is done by GitHub Actions.

for releases is done by lerna.

Compile

Since the monorepo has both go and node code, compilation happens in multiple places. For the node sdks, every package has their own compilation package.json script which gets run. The entrypoint which calls into each package’s script is here. For the go code, all compilation code exists within the Makefile under the release target.

Publish

For node artifacts, e is handled by lerna. For go, publishing is handled by the publish target of the Makefile. Artifacts end up in NPM, DockerHub, and Github.

Push

The tag that gets pushed contains the changes for the bumped monorepo . Here is an example commit.

项目信息

开发语言：TypeScript

Star 数：1470

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕LunaSec - Dependency Security Scanner that automatically notifies you about vulnerabilities like Log4Shell or node-ipc in your Pull Requests and Builds. Protect yourself in 30 seconds with the LunaTrace GitHub App: 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。