Repositories list

• malicious-packages

  Public

  ossf/malicious-packages’s past year of commit activity
  A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

  Go

  •

  Apache License 2.0

  •82•483•21•8•Updated Apr 6, 2026Apr 6, 2026

• scorecard

  Public

  ossf/scorecard’s past year of commit activity
  OpenSSF Scorecard - Security health metrics for Open Source

  scorecardopenssf-scorecard

  scorecardopenssf-scorecard

  Go

  •

  Apache License 2.0

  •619•5.4k•364•37•Updated Apr 6, 2026Apr 6, 2026

• wg-securing-software-repos

  Public

  ossf/wg-securing-software-repos’s past year of commit activity
  OpenSSF Working Group on Securing Software Repositories

  Other

  •29•128•11•4•Updated Apr 6, 2026Apr 6, 2026

• glossary

  Public

  ossf/glossary’s past year of commit activity
  A reference for common terms when talking about OpenSSF and open source software security.

  JavaScript

  •

  Apache License 2.0

  •6•4•4•2•Updated Apr 6, 2026Apr 6, 2026

• cve-bin-tool

  Public

  ossf/cve-bin-tool’s past year of commit activity
  The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl…

  pythonsecurityvulnerability+ 11

  pythonsecurityvulnerabilityvulnerabilitiescvehacktoberfestcvsssecurity-automationsecurity-toolsdevsecops+ 4

  Python

  •

  GNU General Public License v3.0

  •613•1.7k•143•50•Updated Apr 6, 2026Apr 6, 2026

• security-baseline

  Public

  ossf/security-baseline’s past year of commit activity
  Go

  •

  Apache License 2.0

  •37•149•58•5•Updated Apr 6, 2026Apr 6, 2026

• allstar

  Public

  ossf/allstar’s past year of commit activity
  GitHub App to set and enforce security policies

  Go

  •

  Apache License 2.0

  •144•1.4k•61•1•Updated Apr 6, 2026Apr 6, 2026

• secure-sw-dev-fundamentals

  Public
  Secure Software Development Fundamentals courses (from the OpenSSF Best Practices WG)

  CSS

  •

  Creative Commons Attribution 4.0 International

  •51•202•34•3•Updated Apr 3, 2026Apr 3, 2026

• pvtr-github-repo-scanner

  Public

  ossf/pvtr-github-repo-scanner’s past year of commit activity
  Privateer plugin for scanning the security hygiene of a GitHub repository.

  Go

  •

  Apache License 2.0

  •12•21•22•5•Updated Apr 3, 2026Apr 3, 2026

• oss-crs

  Public

  ossf/oss-crs’s past year of commit activity
  oss-crs

  Python

  •

  MIT License

  •3•40•30•6•Updated Apr 3, 2026Apr 3, 2026

• alpha-omega

  Public

  ossf/alpha-omega’s past year of commit activity
  Our mission is to catalyze sustainable improvements to critical open source software projects and ecosystems.

  securityopensourceopen-source-security

  securityopensourceopen-source-security

  Open Policy Agent

  •

  Apache License 2.0

  •62•121•0•0•Updated Apr 3, 2026Apr 3, 2026

• wg-best-practices-os-developers

  Public

  ossf/wg-best-practices-os-developers’s past year of commit activity
  The Best Practices for OSS Developers working group is dedicated to raising awareness and education of secure code best practices for open source developers.

  JavaScript

  •

  Apache License 2.0

  •191•1k•82•11•Updated Apr 3, 2026Apr 3, 2026

• scorecard-action

  Public
  Official GitHub Action for OpenSSF Scorecard.

  githubsecuritysupply-chain+ 2

  githubsecuritysupply-chaingithub-actionsopenssf-scorecard

  Go

  •

  Apache License 2.0

  •83•368•30•15•Updated Apr 3, 2026Apr 3, 2026

• scorecard-webapp

  Public
  Website and API for OpenSSF Scorecard

  openssf-scorecard

  openssf-scorecard

  Go

  •

  Apache License 2.0

  •30•28•31•27•Updated Apr 3, 2026Apr 3, 2026

• wg-globalcyberpolicy

  Public
  Global Cyber Policy Working Group

  Apache License 2.0

  •19•109•15•0•Updated Apr 2, 2026Apr 2, 2026

• tac

  Public
  Technical Advisory Council

  Other

  •77•139•39•20•Updated Apr 2, 2026Apr 2, 2026

• ossf-landscape

  Public
  Apache License 2.0

  •28•31•0•1•Updated Apr 1, 2026Apr 1, 2026

• osv-schema

  Public
  Open Source Vulnerability schema.

  Go

  •

  Apache License 2.0

  •115•243•49•9•Updated Mar 31, 2026Mar 31, 2026

• si-tooling

  Public
  Python

  •

  Apache License 2.0

  •4•8•2•2•Updated Mar 30, 2026Mar 30, 2026

• fuzz-introspector

  Public
  Fuzz Introspector -- introspect, extend and optimise fuzzers

  testingsecurityfuzzing+ 3

  testingsecurityfuzzingfuzz-testingvulnerability-analysissecurity-research

  Python

  •

  Apache License 2.0

  •83•454•108•10•Updated Mar 30, 2026Mar 30, 2026

• scorecard-monitor

  Public
  Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts

  securitysecurity-auditsecurity-tools+ 3

  securitysecurity-auditsecurity-toolsgithub-actionsopen-source-managementopenssf-scorecard

  JavaScript

  •

  Apache License 2.0

  •14•47•13•10•Updated Mar 28, 2026Mar 28, 2026

• wg-orbit

  Public
  ORBIT: Open Resources for Baselines, Interoperability, and Tooling

  Apache License 2.0

  •4•22•7•1•Updated Mar 19, 2026Mar 19, 2026

• security-insights

  Public
  Machine-readable specification for the attestation of security-relevant data.

  Go

  •

  Other

  •16•73•5•2•Updated Mar 19, 2026Mar 19, 2026

• artwork

  Public
  OpenSSF Artwork

  Apache License 2.0

  •10•8•0•0•Updated Mar 17, 2026Mar 17, 2026

• toolbelt

  Public
  Apache License 2.0

  •6•26•0•0•Updated Mar 17, 2026Mar 17, 2026

• orbit-launchpad

  Public
  Apache License 2.0

  •1•2•2•1•Updated Mar 8, 2026Mar 8, 2026

• SIRT

  Public
  The OSS-SIRT SIG (Open Source Software Security Incident Response Team Special Interest Group) is a group working within the OSSF's Vulnerability Disclosure Wor…

  Apache License 2.0

  •6•10•2•1•Updated Mar 1, 2026Mar 1, 2026

• sbom-everywhere

  Public
  Improve Software Bill of Materials (SBOM) tooling and training to encourage adoption

  Vue

  •

  Apache License 2.0

  •41•112•23•14•Updated Feb 28, 2026Feb 28, 2026

• package-analysis

  Public
  Open Source Package Analysis

  Go

  •

  Apache License 2.0

  •64•872•66•17•Updated Feb 27, 2026Feb 27, 2026

• security-assessments

  Public
  Apache License 2.0

  •7•18•7•2•Updated Feb 26, 2026Feb 26, 2026