SafeDep

SafeDep is a real-time open source software supply chain security platform. It concentrates on identifying and stopping malicious packages before they are installed, rather than only reporting known vulnerabilities after the fact. The site combines product documentation with a security blog that analyzes recent supply chain incidents.

The platform covers dependency scanning and SBOM generation, install-time blocking of malicious packages, CI/CD pipeline protection, and monitoring of AI coding agents and MCP servers. A threat intelligence API provides programmatic verdicts on package safety, while tools like PMG and GRYPH extend protection to developer endpoints and agent workflows.

The blog publishes technical incident analyses, including a detailed report on a compromised LiteLLM 1.107.0 release on PyPI that shipped a .pth credential stealer and a sitecustomize.py backdoor. These writeups explain how implants enter packages, what data they target, and which indicators of compromise to check.

SafeDep is intended for developers, DevSecOps engineers and security teams that manage open source dependencies and AI tooling. Teams adopting AI coding agents may find the agent discovery and monitoring features particularly relevant.

To get value from the site, start with the blog for incident context, then review the product pages for scanning and blocking capabilities. A free tier is available for evaluation. Overall, SafeDep is a practical resource for teams treating package ins