hemlock-scan
PulseGate's liveness check found it on 14 Oct 2026; it is registered on GitHub and PyPI and has been in the index since 31 Jul 2026. How this is checked
hemlock-scan is an open-source supply-chain scanner for npm and PyPI packages. It analyzes package behavior to identify potential attacks such as typosquatting and other malicious patterns, going beyond traditional CVE-based vulnerability scanning. It is designed for developers and security teams integrating it into their CI/CD pipelines or local workflows.
Inferred · not functionally tested
Overview
5 featuresPurpose: Detecting malicious or typo-squatted packages in npm and PyPI supply chains that exhibit attack-like behavior but lack a published CVE.
Inferred · not functionally tested
Audience: developers
Inferred · not functionally tested
Functions: monitoring
Inferred · not functionally tested
Interfaces: API: unknown · MCP: unknown · CLI: indicated (inferred, not tested) · Self-hosting: unknown
Recorded constraints: pricing: open_source · license: MIT · platforms: CLI · deployment: cli
Constraint provenance is unknown; confirm requirements with the publisher.
Record sources: pypi.org · github.com. These links do not verify the individual claims.
hemlock-scan is an Application security & vulnerability scanning project. Inferred · not functionally tested: It focuses on detecting malicious or typo-squatted packages in npm and PyPI supply chains that exhibit attack-like behavior but lack a published CVE. Inferred · not functionally tested: hemlock-scan is an open-source project aimed at developers. Basis unknown · not verified: hemlock-scan is open source under the MIT license. Basis unknown · not verified: hemlock-scan is available on the command line.
xzycd builds and maintains hemlock-scan, and it first shipped in 2026. Development happens publicly on GitHub with 20 commits in the last 90 days. Inferred · not functionally tested: Among its 5 catalogued features are Supply Chain Scanning, Malicious Behavior Detection, and Typosquatting Detection.
Summary written by a language model from the project’s public pages.
Tasks: Inferred · not functionally tested
- Supply Chain Scanning
- Malicious Behavior Detection
- Typosquatting Detection
- npm Support
- PyPI Support
Topics: Inferred · not functionally tested
Built with & integrations
Trust & compliance
Indexing history
1What PulseGate has recorded for this listing
- Indexed31 Jul · 23:29 UTChemlock-scan seen via PyPI Bulk EnumeratorSource: PyPI Bulk Enumerator · Open
Frequently asked questions about hemlock-scan
- What is hemlock-scan?
- Inferred · not functionally tested: Hemlock-scan focuses on detecting malicious or typo-squatted packages in npm and PyPI supply chains that exhibit attack-like behavior but lack a published CVE. It is catalogued under Application security & vulnerability scanning on PulseGate.
- Who is hemlock-scan for?
- Inferred · not functionally tested: hemlock-scan is an open-source project built for developers.
- Is hemlock-scan free?
- Basis unknown · not verified: Yes — hemlock-scan is open source under the MIT license and free to use.
- What platforms does hemlock-scan run on?
- Basis unknown · not verified: hemlock-scan runs on the command line.
- Is hemlock-scan still active?
- PulseGate's liveness check found it on 14 Oct 2026. Its GitHub repository shows 20 commits in the last 90 days.
- Who develops hemlock-scan?
- hemlock-scan is developed by xzycd.
- How long has hemlock-scan been around?
- hemlock-scan first shipped in 2026.
- Is hemlock-scan open source?
- Basis unknown · not verified: Yes — hemlock-scan is open source under the MIT license, developed on GitHub.
Similar projects
Closest matches by what these projects do