hemlock-scan
hemlock-scan is an open-source supply-chain scanner for npm and PyPI packages. It analyzes package behavior to identify potential attacks such as typosquatting and other malicious patterns, going beyond traditional CVE-based vulnerability scanning. It is designed for developers and security teams integrating it into their CI/CD pipelines or local workflows.
Open SourceMITCLI
1star
5features
2026since
Overview
5 featureshemlock-scan is an Other dev tools project. It focuses on detecting malicious or typo-squatted packages in npm and PyPI supply chains that exhibit attack-like behavior but lack a published CVE. hemlock-scan is an open-source project aimed at developers. hemlock-scan is open source under the MIT license. hemlock-scan is available on the command line.
xzycd builds and maintains hemlock-scan, and it first shipped in 2026. Development happens publicly on GitHub with 20 commits in the last 90 days. Among its 5 catalogued features are Supply Chain Scanning, Malicious Behavior Detection, and Typosquatting Detection.
Summary written by a language model from the project’s public pages.
- Supply Chain Scanning
- Malicious Behavior Detection
- Typosquatting Detection
- npm Support
- PyPI Support
Tags
supply-chain-securitydependency-scanningtyposquatting-detectionsastsbom
Built with & integrations
Runs on
CLI
Trust & compliance
License
MIT
Verified signals
Indexing history
1What PulseGate has recorded for this listing
Frequently asked questions about hemlock-scan
- What is hemlock-scan?
- Hemlock-scan focuses on detecting malicious or typo-squatted packages in npm and PyPI supply chains that exhibit attack-like behavior but lack a published CVE. It is catalogued under Other dev tools on PulseGate.
- Who is hemlock-scan for?
- hemlock-scan is an open-source project built for developers.
- Is hemlock-scan free?
- Yes — hemlock-scan is open source under the MIT license and free to use.
- What platforms does hemlock-scan run on?
- hemlock-scan runs on the command line.
- Is hemlock-scan still active?
- The GitHub repository shows 20 commits in the last 90 days.
- What are alternatives to hemlock-scan?
- Similar projects tracked by PulseGate include git-build-commit, funkuino, and click-docs.git-build-commitfunkuinoclick-docs
- Who develops hemlock-scan?
- hemlock-scan is developed by xzycd.
- How long has hemlock-scan been around?
- hemlock-scan first shipped in 2026.
Also in Other dev tools
Same category — not a similarity match