PackageGuard - Get a grip on your open-source packages

Everything it does

Every Ecosystem

Scan NuGet, NPM, PNPM and Yarn dependencies, using the same feeds and credential providers as dotnet, your package manager and your IDE. Private feeds included.

🛡️

Allow and Deny Lists

Decide which licenses, packages and versions are acceptable. Match on wildcards and NuGet version ranges, and keep pre-releases out. Deny rules always win over allow rules.

🗂️

Hierarchical Configuration

Put a repository-wide policy next to your solution and refine it per project. PackageGuard finds the configuration files and merges them for you.

📊

Risk Scores

Score every package from 0 to 100, weighted across legal risk (20%), security risk (45%) and operational risk (35%). Missing evidence is scored conservatively rather than ignored.

🚨

Vulnerabilities and Supply Chain

Read known vulnerabilities from OSV, including transitive ones. Check package signing, publisher trust, build provenance, branch protection and the OpenSSF Scorecard.

🧾

Reports and SBOM

A console summary, an HTML report and a SARIF file for code scanning. Emit the dependency graph as CycloneDX or SPDX, with package URLs, license evidence and vulnerabilities.

Every score comes with its reasoning

--report-risk writes a self-contained HTML report and a matching SARIF file. The HTML has no scripts and no external assets, so you can publish it straight from a build. Every point a package loses is listed, with a link to the evidence behind it.

A PackageGuard risk report: package counts by risk zone, a status check summary, a package summary table, and a per-package breakdown into legal, security and operational scores with the reasoning behind each one — The top of a real report, with the per-package evidence lists left out to keep the picture short. Click it to see it full size.

What gets measured SBOM output