Tools and practices for supply chain security when using this project.

Verdict: Trivy is the best recommendation for any developer — zero auth, local, fast, scans everything. OSV-Scanner is ideal for precision (fewer false positives). Snyk is the worst fit here due to mandatory account + cloud dependency + free tier limits.

Socket.dev detects malicious packages before you install them. Unlike CVE-based scanners, it analyzes package behavior: obfuscated code, network access in install scripts, typosquatting, and suspicious maintainer activity.

npm install -g socket
socket login                          # Requires account at socket.dev
socket wrapper on                     # Transparent npm/npx wrapping

# CI gate
socket ci

# Manual scan
socket scan create --report

Trivy by Aqua Security scans dependencies, IaC, secrets, containers, and SBOMs — all from a single binary. No account, no SaaS, no rate limits.

# Install
brew install trivy

# Scan current project dependencies
trivy fs --severity HIGH,CRITICAL --exit-code 1 .

# Scan with all detectors
trivy fs --scanners vuln,secret,config --severity HIGH,CRITICAL .

# Scan a specific lockfile
trivy fs --severity HIGH,CRITICAL /path/to/package-lock.json

# SARIF output for GitHub Security tab
trivy fs --format sarif --output results.sarif .

- uses: aquasecurity/trivy-action@v0.36.0
  with:
    scan-type: 'fs'
    scan-ref: '.'
    format: 'sarif'
    output: 'trivy-results.sarif'
    exit-code: '1'
    severity: 'CRITICAL,HIGH'

OSV-Scanner by Google matches vulnerabilities to precise commit hashes rather than version ranges. This minimizes false positives. It uses the OSV.dev database (aggregates from GitHub Advisories, RustSec, Go vulndb, npm, PyPI, and more).

# Install
brew install osv-scanner

# Scan project (recursively finds all lockfiles)
osv-scanner scan -r .

# Scan a specific lockfile
osv-scanner scan -L package-lock.json

# Guided remediation (npm, Maven)
osv-scanner fix -M package.json -L package-lock.json

jobs:
  scan:
    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8"

Copy the sections below that match the tools you use. Each is independent — add only what you have installed.

## Security Scanning

Before installing packages: `socket npm install <pkg>` (if Socket.dev installed)

## Security Scanning

Before pushing: `trivy fs --severity HIGH,CRITICAL --exit-code 1 .` (if Trivy installed)

## Security Scanning

Before pushing: `osv-scanner scan -r .` (if OSV-Scanner installed)

If using multiple tools, combine them into one block:

## Security Scanning

Before installing packages: `socket npm install <pkg>` (if Socket.dev installed)
Before pushing:
- `trivy fs --severity HIGH,CRITICAL --exit-code 1 .` (if Trivy installed)
- `osv-scanner scan -r .` (if OSV-Scanner installed)

Each layer catches different things:

Socket.dev blocks attacks at install time. Trivy provides broad coverage. OSV-Scanner adds precision if false positives are a concern.

Start with Trivy — it covers the most ground with zero friction. Add Socket.dev for install-time malware protection. Add OSV-Scanner if false positives become a problem.

• Installation Guide — how stelow itself is distributed