SupplyDrift

TL;DR

🚀 What it does: Find phantom dependencies that lockfile-centered SCA misses by comparing evidence from source repositories, shipped images, running infrastructure, and developer endpoints.

💡 Best for: Security teams that need a unified view of declared dependencies and the components their systems actually fetch, execute, ship, and run.

🔍 Key features: Repository and image scanning, runtime discovery, endpoint inventory, normalized SBOM data, vulnerability and malware views, and component blast-radius analysis.

Overview

SupplyDrift is a software supply chain security platform that discovers phantom dependencies: components trusted by repositories, builds, images, clusters, or endpoints that remain invisible to lockfile-centered Software Composition Analysis.

Instead of treating a lockfile as the sole source of truth, SupplyDrift independently observes repositories, shipped container images, running cloud and Kubernetes workloads, and developer endpoints. It brings that evidence together in a normalized inventory so security teams can identify the gap between declared intent and operational reality.

Key Features

• Repository scanning — Detects dependencies introduced through CI workflows, install scripts, unpinned GitHub Actions, remote package URLs, and other non-lockfile paths.
• Container and runtime visibility — Builds ground-truth inventories for container images and discovers workloads running across registries, Kubernetes, EKS, and ECS.
• Endpoint inventory — Collects local package evidence from developer machines to support compromised-package response.
• Unified security evidence — Combines SBOM, vulnerability, malware, deployment, asset-topology, and component blast-radius data in one platform.
• On-demand scanning — Provides a web interface and API backed by dedicated repository, image, and malware scan runners.

Repository

🔗 View SupplyDrift on GitHub