Open Source Manager
Open source security intelligence with vulnerability tracking, attestation verification, and license compliance
Open Source Manager (OSM)
Open source is everywhere—and so are its vulnerabilities. OSM provides comprehensive open source security intelligence, similar to Snyk's vulnerability database, giving you detailed information about package security, vulnerabilities, and compliance.
Make informed decisions about your dependencies.
Key Features
Open Source Security Database
- Comprehensive vulnerability database
- Package security intelligence
- Real-time vulnerability tracking
- Historical security data
Vulnerability Intelligence
- CVE details and analysis
- CVSS scoring and severity
- Exploit availability information
- Fix recommendations
- Affected version ranges
Attestation Verification
- SLSA provenance verification
- Sigstore signature validation
- Build reproducibility
- Supply chain integrity
License Compliance
- License detection and classification
- Compatibility analysis
- Policy enforcement
- Attribution generation
What's Included
Security Database
Browse package security information
Attestation
Supply chain verification
License Compliance
License management
Open Source Security Database
Search and browse security information for open source packages:
Package Information
| Field | Description |
|---|---|
| Package Name | Name and ecosystem (npm, PyPI, Maven, etc.) |
| Version History | All versions with security status |
| Vulnerabilities | Known CVEs affecting the package |
| Severity Distribution | Critical, High, Medium, Low breakdown |
| License | SPDX license identifier |
| Maintainer Status | Active maintenance indicator |
| Security Advisories | Related security bulletins |
Vulnerability Details
For each vulnerability:
- CVE identifier and description
- Affected version ranges
- Fixed versions
- CVSS score and vector
- Exploit information
- Remediation guidance
Getting Started
- Navigate to the OSM security database
- Search for packages by name or CVE
- Review security information
- Check attestation status
- Verify license compliance
Use Cases
Pre-Installation Review
Before adding a new dependency, check its security posture:
- Known vulnerabilities
- Maintenance status
- License compatibility
Vulnerability Research
When responding to security alerts:
- Detailed CVE analysis
- Impact assessment
- Remediation options
Compliance Auditing
For regulatory requirements:
- License inventory
- Security attestation
- Supply chain verification
Integration with ESSCM
OSM data is integrated into Enterprise Software Supply Chain Manager (ESSCM):
- Automatic vulnerability matching
- License policy enforcement
- Attestation verification during SBOM generation