Repositories list

• scancode.io

  Public
  ScanCode.io is a server to script and automate software composition analysis pipelines with ScanPipe pipelines. This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ Google Summer of Code, nexB and others generous sponsors!

  dockeropen-sourcevirtual-machine+ 10vulnerabilitieslicensespdxscascancodesoftware-composition-analysispurl+ 3

  Python

  •

  Apache License 2.0

  •138•156•429•28•Updated Dec 11, 2025Dec 11, 2025

• aboutcode-mirror-nuget-catalog

  Public

  aboutcode-org/aboutcode-mirror-nuget-catalog’s past year of commit activity
  Append-only mirror of NuGet Catalog, updated hourly

  Python

  •1•1•0•0•Updated Dec 11, 2025Dec 11, 2025

• purldb

  Public

  aboutcode-org/purldb’s past year of commit activity
  Tools to create and expose a database of purls (Package URLs). This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ and nexB for https://www.aboutcode.org/ Chat is at https://gitter.im/aboutcode-org/discuss

  purlpackage-url

  HTML

  •40•55•287•6•Updated Dec 11, 2025Dec 11, 2025

• scancode-analyzer

  Public

  aboutcode-org/scancode-analyzer’s past year of commit activity
  scancode-results-analyzer

  Python

  •3•4•15•1•Updated Dec 10, 2025Dec 10, 2025

• rpm-inspector

  Public

  aboutcode-org/rpm-inspector’s past year of commit activity
  A Python library to collect data from RPM packages including installed packages.

  Batchfile

  •0•0•1•0•Updated Dec 10, 2025Dec 10, 2025

• dejacode

  Public
  Automate open source license compliance and ensure software supply chain integrity

  open-sourcevulnerabilitieslicense+ 7spdxscascancodepurlpackage-urlcyclonedxfoss-compliance

  Python

  •

  GNU Affero General Public License v3.0

  •18•36•88•5•Updated Dec 10, 2025Dec 10, 2025

• www.aboutcode.org

  Public

  aboutcode-org/www.aboutcode.org’s past year of commit activity
  Staging, issue content tidbits for AboutCode.org

  JavaScript

  •1•0•54•0•Updated Dec 10, 2025Dec 10, 2025

• aboutcode-mirror-kev

  Public
  AboutCode Mirror for CISA Known Exploited Vulnerabilities

  4•0•0•0•Updated Dec 10, 2025Dec 10, 2025

• scancode-licensedb

  Public

  aboutcode-org/scancode-licensedb’s past year of commit activity
  A free and open database of all the licenses, in particular all the open source software licenses

  fosslicensescancode-toolkit+ 1scancode-licensedb

  Makefile

  •9•55•21•2•Updated Dec 9, 2025Dec 9, 2025

• scancode-toolkit

  Public

  aboutcode-org/scancode-toolkit’s past year of commit activity
  🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!

  licensingpackagesopen-source-licensing+ 17dependency-graphprovenancedependencieslicensespdxcopyrightsca+ 10

  Python

  •635•2.4k•1.2k•71•Updated Dec 9, 2025Dec 9, 2025

• aboutcode-toolkit

  Public
  ✅ AboutCode Toolkit provides a simple way to document provenance metadata (origin and license) about third-party code that you use in your project: it includes utilities to generate inventory/BOM or Attribution documentation.

  Python

  •49•99•6•13•Updated Dec 5, 2025Dec 5, 2025

• packageurl.rs

  Public
  Rust implementation of the Package URL specification.

  Rust

  •

  MIT License

  •15•0•0•0•Updated Dec 4, 2025Dec 4, 2025

• aboutcode

  Public

  aboutcode-org/aboutcode’s past year of commit activity
  AboutCode project: tools and data to uncover things about code: the provenance, origin, license, and more (packages, security, quality, etc.) of FOSS code. Get started at https://aboutcode.readthedocs.io/

  securitylicensesca+ 5scancodepurlsbomaboutcodedejacode

  Batchfile

  •185•256•29•27•Updated Dec 4, 2025Dec 4, 2025

• packageurl-php

  Public
  PHP implementation of the package url spec

  PHP

  •

  MIT License

  •7•1•0•0•Updated Dec 4, 2025Dec 4, 2025

• packageurl-go

  Public
  Go implementation of the package url spec

  Go

  •

  MIT License

  •50•0•0•0•Updated Dec 4, 2025Dec 4, 2025

• intbitset

  Public
  Python C-based extension implementing fast integer bit sets

  Cython

  •

  GNU Lesser General Public License v3.0

  •17•0•1•0•Updated Dec 3, 2025Dec 3, 2025

• packageurl-java

  Public
  Java/JVM implementation of the package url spec

  Java

  •

  MIT License

  •19•0•0•0•Updated Dec 3, 2025Dec 3, 2025

• scancode-action

  Public

  aboutcode-org/scancode-action’s past year of commit activity
  Run ScanCode.io pipelines from your Workflows

  licensespdxscancode+ 1cyclonedx

  Apache License 2.0

  •3•12•5•2•Updated Dec 3, 2025Dec 3, 2025

• aboutcode-mirror-euvd

  Public

  aboutcode-org/aboutcode-mirror-euvd’s past year of commit activity
  Mirror of European Union Vulnerability Database (EUVD)

  mirrorvulnerabilityeuvd

  1•0•0•1•Updated Dec 2, 2025Dec 2, 2025

• vulnerablecode

  Public
  A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/

  securityvulnerabilitysnyk+ 15vulnerability-databasesvulndbcvecpenvdvulnerability-detectionosv+ 8

  Python

  •

  Apache License 2.0

  •252•640•677•73•Updated Nov 28, 2025Nov 28, 2025

• fetchcode

  Public
  A library to reliably fetch code via HTTP, FTP and version control systems. This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ Google Summer of Code, nexB and others generous sponsors!

  HTML

  •20•11•53•10•Updated Nov 28, 2025Nov 28, 2025

• packageurl-dotnet

  Public
  .NET implementation of the package url spec

  C#

  •

  MIT License

  •14•0•0•0•Updated Nov 25, 2025Nov 25, 2025

• fingerprints

  Public
  Make it easier to compare and cross-reference the names of companies and people by applying strong normalisation.

  Python

  •

  MIT License

  •18•0•0•2•Updated Nov 24, 2025Nov 24, 2025

• packageurl-swift

  Public
  Swift implementation of the package url spec

  Swift

  •

  MIT License

  •2•0•0•0•Updated Nov 21, 2025Nov 21, 2025

• packageurl-ruby

  Public
  Ruby implementation of the package url spec

  Ruby

  •

  MIT License

  •4•1•0•0•Updated Nov 21, 2025Nov 21, 2025

• purlvalidator-go

  Public
  Offline Package URL validator using a prebuilt FST of known packages.

  fstpurlairgapped+ 2sbom-toolpackageurl

  Go

  •

  Apache License 2.0

  •0•0•0•0•Updated Nov 18, 2025Nov 18, 2025

• vulnerablecode-ai-experiments

  Public
  Experiments with AI to analyze vulnerabilities

  Python

  •2•1•2•0•Updated Nov 15, 2025Nov 15, 2025

• univers

  Public
  Parse and compare all the package versions and all the ranges. From debian, npm, pypi, ruby and more. Process all the version range specs and expressions. This project is sponsored by an NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ , the Google Summer of Code, nexB and others generous sponsors!

  package-managerversioningversion+ 7vulnerabilitiesdependenciesosvdependency-resolverpurlpackage-urlvulnerablecode

  Python

  •18•38•48•12•Updated Nov 12, 2025Nov 12, 2025

• purl-validator.rs

  Public
  Offline Package URL validator using a prebuilt FST of known packages.

  fstpurlairgapped+ 2sbom-toolpackageurl

  Rust

  •

  Apache License 2.0

  •0•0•0•0•Updated Nov 12, 2025Nov 12, 2025

• aboutcode.federated

  Public
  Federated data utilities

  Python

  •0•0•0•0•Updated Nov 8, 2025Nov 8, 2025