{"id":19260323,"url":"https://github.com/mitre/hipcheck","last_synced_at":"2025-04-04T08:04:09.379Z","repository":{"id":114816298,"uuid":"584926687","full_name":"mitre/hipcheck","owner":"mitre","description":"Automatically assess and score software repositories for supply chain risk.","archived":false,"fork":false,"pushed_at":"2024-10-29T14:31:55.000Z","size":5420,"stargazers_count":72,"open_issues_count":53,"forks_count":5,"subscribers_count":11,"default_branch":"main","last_synced_at":"2024-10-29T14:58:36.698Z","etag":null,"topics":["supply-chain-security"],"latest_commit_sha":null,"homepage":"https://mitre.github.io/hipcheck/","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mitre.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-01-03T21:52:11.000Z","updated_at":"2024-10-29T14:34:09.000Z","dependencies_parsed_at":null,"dependency_job_id":"0542eee3-d57a-4b75-bba2-2e416e2c4325","html_url":"https://github.com/mitre/hipcheck","commit_stats":null,"previous_names":[],"tags_count":95,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fhipcheck","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fhipcheck/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fhipcheck/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fhipcheck/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mitre","download_url":"https://codeload.github.com/mitre/hipcheck/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246828484,"owners_count":20840474,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["supply-chain-security"],"created_at":"2024-11-09T19:19:54.420Z","updated_at":"2025-04-04T08:04:09.355Z","avatar_url":"https://github.com/mitre.png","language":"Rust","funding_links":[],"categories":["Rust"],"sub_categories":[],"readme":"# Hipcheck \u0026#x2713;\n\n[![License: Apache-2.0](https://img.shields.io/github/license/mitre/hipcheck)][license]\n[![GitHub Release](https://img.shields.io/github/v/release/mitre/hipcheck)][release]\n[![Hipcheck Website](https://img.shields.io/badge/Website-blue)][website]\n![docker build](https://github.com/mitre/hipcheck/actions/workflows/docker.yml/badge.svg)\n\n_Helping maintainers assess software packages for long term risk._\n\nManaging the security risk of third-party software at scale is difficult.\nNormal projects can easily have hundreds of dependencies; far too many to\nreview by hand.\n\nHipcheck is designed to help you filter that list of dependencies down to just\na few that appear concerning, and to give you the information you need to make\na security decision quickly.\n\nHipcheck is a command line interface (CLI) tool for analyzing open source\nsoftware packages and source repositories to understand their software supply\nchain risk. It analyzes a project's _software development practices_ and\ndetects _active supply chain attacks_ to give you both a long-term and\nimmediate picture of the risk from using a package.\n\n## Very Quick Explanation\n\nHipcheck can analyze Git source repositories and open source packages from\npopular package hosts.\n\n```sh\n# Analyze Express, a popular JavaScript package for web servers, with the\n# URL of its Git repository.\nhc check https://github.com/expressjs/express\n\n# Analyze urllib3 version 2.2.2, a popular URL-handling package hosted on PyPI.\nhc check -t pypi urllib3@2.2.2\n\n# Analyze the package described by an SPDX Software Bill of Materials.\nhc check example-sbom.spdx.json\n```\n\nFor more information, check out the [Quickstart Guide][quickstart].\n\n## Installation\n\nSee the [Installation Instructions][install].\n\n## Values\n\nHipcheck's product values are to be:\n\n* __Configurable:__ Hipcheck should be adaptable to the policies of its users.\n* __Fast:__ Hipcheck should provide answers quickly.\n* __Actionable:__ Hipcheck should empower users to make informed security\n  decisions.\n\nRead more about Hipcheck's product and project values in [RFD #2][rfd_2].\n\n## License\n\nHipcheck's software is licensed under the Apache 2.0 license, which can be\nfound in the [`LICENSE`](LICENSE) file in this repository.\n\n## Public Release\n\n\u003e [!NOTE]\n\u003e Approved for Public Release; Distribution Unlimited. Public Release Case\n\u003e Number 22-2145.\n\u003e\n\u003e Portions of this software were produced for the U.S. Government under\n\u003e Contract No. FA8702-19-C-0001, W56KGU-18-D-0004, and 70RSAT20D00000001\n\u003e and is subject to the [Rights in Noncommercial Computer Software and\n\u003e Noncommercial Computer Software Documentation Clause DFARS 252.227-7014\n\u003e (FEB 2014)][dfars].\n\n[dfars]: https://www.acquisition.gov/dfars/252.227-7014-rights-other-commercial-computer-software-and-other-commercial-computer-software-documentation.\n[quickstart]: https://hipcheck.mitre.org/docs/getting-started/first-run/\n[install]: https://hipcheck.mitre.org/docs/getting-started/install/\n[license]: https://github.com/mitre/hipcheck/blob/main/LICENSE\n[release]: https://github.com/mitre/hipcheck/releases/latest\n[rfd_2]: https://hipcheck.mitre.org/docs/rfds/0002/\n[website]: https://hipcheck.mitre.org\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitre%2Fhipcheck","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmitre%2Fhipcheck","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitre%2Fhipcheck/lists"}