diff --git a/docs/src/data/ecosystem/entries/ossrisk.md b/docs/src/data/ecosystem/entries/ossrisk.md new file mode 100644 index 0000000000..b71f31322a --- /dev/null +++ b/docs/src/data/ecosystem/entries/ossrisk.md @@ -0,0 +1,31 @@ +--- +title: ossrisk +subtitle: Dependency supply-chain risk scanner with Rego policy gates +labels: + category: security + layer: cicd + type: poweredbyopa +inventors: +- depkeep +code: +- https://github.com/depkeep/ossrisk +tutorials: +- https://github.com/depkeep/ossrisk#policy-as-code-opa +software: +- npm +- pypi +- github-actions +--- + +ossrisk scans npm and PyPI dependency trees for supply-chain and long-term +viability risk: known CVEs (via OSV.dev), end-of-life versions, abandonment +signals, typosquatting, license compliance, maintainer-takeover patterns, and +install scripts. + +Beyond a simple `--fail-on ` threshold, ossrisk delegates gating +decisions to OPA. The scan result is passed to `opa eval` as `input`; policies +live in `package ossrisk` and add human-readable messages to a `deny` set, and +any violation fails the scan. This enables cross-signal rules a severity +threshold cannot express - for example "no strong-copyleft licenses in direct +dependencies" or "block packages that add install scripts under a brand-new +publisher" (the event-stream takeover pattern). diff --git a/docs/static/img/ecosystem-entry-logos/ossrisk.svg b/docs/static/img/ecosystem-entry-logos/ossrisk.svg new file mode 100644 index 0000000000..4cd0a04679 --- /dev/null +++ b/docs/static/img/ecosystem-entry-logos/ossrisk.svg @@ -0,0 +1,13 @@ + + + + + + + + + + + + +