PkgRadar.com

PkgRadar provides static supply-chain security tools that help engineering teams identify and block malicious open-source packages before they reach a build. It supports nine package ecosystems: npm, PyPI, RubyGems, Cargo, Maven, NuGet, Composer, Go modules, and Pub (Dart). Users can check individual releases or lockfiles, review stored verdicts and artifact fingerprints, and inspect evidence from package-code analysis performed without executing the code.

Teams can connect the GitHub App or use the CLI in GitHub Actions, GitLab CI, and other pipelines through its CLI and API. PkgRadar lets users set policy thresholds, decide which findings block a build, and choose how to handle releases that cannot be checked. GitHub checks can be configured as required before a merge. The service also offers package intelligence, campaign research, detection-method information, coverage details, methodology, and accuracy benchmarks. A free plan includes 25 scans per rolling 30 days and CI gating within the quota, with no payment card required.