packageguard - Dependency scanner for NuGet and NPM with SBOM, vu

项目说明

<di="center">
<img src="./PackageGuard.png" style="width:300px" alt="PackageGuard"/>
</div>
<h1 align="center">Get a grip on your open-source packages</h4>

<di="center">

![]()
![Co Status]()
![]()
![]()
![]()
!GitHub Repo stars
![GitHub contributors]()
![GitHub last commit]()
![GitHub commit activity]()
![open issues]()
![PRs Welcome]()
![]()
!Static Badge

<a href="#about">About</a> •
<a href="#documentation">Documentation</a> •
<a href="#building">Building</a> •
<a href="#contributing">Contributing</a> •
<a href="#"></a> •
<a href="#credits">Credits</a> •

</div>

Documentation

Visit the official documentation website for the full guide to installing, configuring and running PackageGuard.

Installation - install the global tool or the portable deployment

Getting started with init - scaffold a configuration from the licenses you actually use

Configuration - define your allow- and deny-lists

Usage - run a scan and read the results

Explaining a package - see why a specific package is present and how it was e

Risk Metrics - score packages on legal, security and operational risk

Software Bill of Materials - emit the dependency graph as CycloneDX or SPDX

Caching and Rate Limits - make repeated scans fast and avoid GitHub throttling

Roadmap - what's planned next

About

What's this?

PackageGuard is a fully open-source CLI tool that keeps your open-source supply chain honest. It scans the NuGet, npm, pnpm and Yarn dependencies of your codebase, enforces allow- and deny-lists for licenses, packages and , scores every package's legal/security/operational risk, and can emit a standards-compliant SBOM — all from a single, cacheable command that fits into any CI pipeline.

At a glance, PackageGuard can:

Scan NuGet, npm, pnpm and Yarn dependencies across an entire solution or codebase in one run, direct and transiti

Scaffold a starting configuration (packageguard init) from the licenses actually found in your repository, flagging copyleft licenses and suggesting a policy that fits whether your software is proprietary, SaaS, or open source

Enforce allow- and deny-lists for open-source licenses, specific packages, and package , discovered hierarchically across solution-, project- and repository-le files

Resolve licenses from NuGet/npm metadata, GitHub repositories, and downloaded license text through a chain of fetchers, falling back gracefully when a source doesn't have an answer

Explain a single package on demand (packageguard explain <package>, with fuzzy name matching) - its dependency path, how its was resolved, the exact policy rule and configuration file that allowed or denied it, and its risk breakdown

Score every package's risk across three dimensions - Legal, Security and Operational - via --report-risk, weighing signals such as license compatibility, known (OS activity, package signing, release cadence, and dozens more

Gate policies on that risk data, not just package identity: deny packages by o or per-dimension risk score, OS, unsigned/deprecated/repository-less status, or minimum package age per ecosystem, with documented, expiring exceptions for accepted-risk packages and a warn-only mode (--treat-deny-as-warning) for phasing in new rules

Back every risk score with e, not just a number: each package card in the HTML report has a dedicated E section with collapsible, collapsed-by-default panels naming the exact packages, , GHSA/OS ids and release dates behind its rationale, so you can see *why* a package scored the way it did without digging through logs

Produce a colored console summary, a self-contained HTML report you can open in a browser, and a SARIF file for surfacing and risk findings directly in GitHub code scanning

Generate a standards-compliant Software Bill of Materials (SBOM) in CycloneDX or SPDX JSON format via --sbom, complete with purls, declared- license e, and a direct/transiti graph

Enrich that SBOM with data from OSV when --sbom is combined with --report-risk

Cache package, license and risk data (--use-caching) - including GitHub responses and per-repository risk profiles - to keep repeated scans and CI runs fast, with configurable cache freshness (--risk-cache-max-age-hours, --refresh-risk-cache)

Run as a .NET global tool or a portable, cross-platform (Windows/Linux/macOS) deployment - no CI-specific plugin required

What's so special about that?

I' that the commercial solutions for this are usually very expensive and ha that smaller companies may not need. Hopefully this little tools fills the gap between tools like GitHub's Dependabot and expensi products like Blackduck, SNYK and others.

Who created this?

My name is Dennis Doomen and I'm a Microsoft MVP and Principal Consultant at Avi with 28 years of experience under my belt. As a software architect and/or lead de, I specialize in designing full-stack enterprise solutions based on .NET as well as pro coaching on all aspects of designing, building, deploying and maintaining software systems. I'm the author of several open-source projects such as Fluent Assertions, Reflectify, Liquid Projections, and I've been maintaining coding guidelines for C# since 2001.

Contact me through Email, Bluesky, Twitter/X or Mastadon

Building

To build this repository locally, you need the following:
* The .NET SDK for .NET 9.0 or later (the repository multi-targets net9.0 and net10.0; global.json pins local builds to the .NET 10 SDK).
* NPM, PNPM and Yarn a in your PATH
* Studio, JetBrains Rider or Studio Code with the C# DevKit

You can also build, run the unit tests and package the code using the following command-line:

build.ps1

Or, if you have, the Fallout tool installed:

fallout

Also try using --help to see all the a options or --plan to see what the scripts does.

Contributing

Your contributions are always welcome! Please have a look at the contribution guidelines first.

Previous contributors include:

<a href="
<img src=" alt="contrib.rocks image" />
</a>

(Made with contrib.rocks)

This library uses Semantic to gi to the numbers. For the a, see the tags on this repository.

Credits

This library wouldn't have been possible without the following tools, packages and companies:

* Spectre.Console - a .NET library that makes it easier to create beautiful console applications.
* Fallout - .NET build automation, the hard-fork successor to Nuke by Matthias Koch
* CliWrap - Library for running command-line processes by Oleksii Holub
* Co - Cross platform code co for .NET by Toni Solarin-Sodara
* Git - From git log to SemVer in no time
* ReportGenerator - Converts co reports by Daniel Palme
* StyleCopyAnalyzer - StyleCop rules for .NET
* Roslynator - A set of code analysis tools for C# by Josef Pihrt
* Serilog - Flexible, structured events — log file con
* CSharpCodingGuidelines - Roslyn analyzers by Bart Koelman to go with the C# Coding Guidelines
* Meziantou - Another set of awesome Roslyn analyzers by Gérald Barré
* FluentAssertions - Extension methods to fluently assert the outcome of .NET tests
* - Snapshot testing by Simon Cropp
* Pathy - Fluently building and using file and directory paths without binary dependencies
* MemoryPack - Zero encoding extreme performance binary serializer for C# and Unity by Yoshifumi Kawai

Support the project

* Sponsor me
* Tip Me
* Buy me a Coffee

You may also like

* My Blog
* Reflectify - Reflection extensions without causing dependency pains
* .NET Library Starter Kit - A battle-tested starter kit for building open-source and internal NuGet libraries using "dotnet new", born from half a billion downloads
* C# Coding Guidelines - Forkable coding guidelines for all C#

License

This project is licensed under the MIT License - see the LICENSE file for details.

项目信息

开发语言：C#

Star 数：79

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Dependency scanner for NuGet and NPM with SBOM, vulnerabilities and risk analysis展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。