AppSecNews

SCA

Software Composition Analysis

Identify open-source dependencies and match them against known vulnerability and license data.

28 tools profiled

How it differs Checks the open source packages you depend on for known vulnerabilities and license obligations. Flaws in code you wrote are SAST territory.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

4 tools match

Active Library Clear all

  • cdxgen

    CycloneDX

    SCA

    A command line SBOM generator that produces CycloneDX bills of materials from source projects, container images, binaries and operating system packages across many ecosystems.

    Open source
    Established

  • OSV-Scanner

    Google

    SCA

    Command line scanner that matches lockfiles, SBOMs and container contents against the OSV.dev advisory database using precise affected version ranges.

    Open source
    Growing

  • OWASP Dependency-Check

    OWASP

    SCA

    Long running OWASP project that identifies dependencies by collecting evidence from artifacts, maps them to CPE identifiers, and reports matching CVEs from the National Vulnerability Database.

    Open source
    Established

  • Syft

    Anchore

    SCA

    Command line SBOM generator that catalogs packages in container images, filesystems and archives, emitting SPDX, CycloneDX or its own JSON format.

    Open source
    Established

  • cdxgen

    CycloneDX

    A command line SBOM generator that produces CycloneDX bills of materials from source projects, container images, binaries and operating system packages across many ecosystems.

    Open source Established
    SCA

  • OSV-Scanner

    Google

    Command line scanner that matches lockfiles, SBOMs and container contents against the OSV.dev advisory database using precise affected version ranges.

    Open source Growing
    SCA

  • OWASP Dependency-Check

    OWASP

    Long running OWASP project that identifies dependencies by collecting evidence from artifacts, maps them to CPE identifiers, and reports matching CVEs from the National Vulnerability Database.

    Open source Established
    SCA

  • Syft

    Anchore

    Command line SBOM generator that catalogs packages in container images, filesystems and archives, emitting SPDX, CycloneDX or its own JSON format.

    Open source Established
    SCA
Tick up to 4 tools above.