{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/2"}],"enrichment":{"capability":"GuardDog is a CLI tool that scans PyPI, npm, Go, Rust, RubyGems, GitHub Actions, and VSCode extension packages to identify malicious code and supply chain attacks using YARA rules and metadata analysis.","skillfed_tags":["supply-chain-security","malware-detection","multi-ecosystem"],"use_cases":["Scan dependencies in a requirements.txt or package.lock file before deployment to catch known malicious packages","Integrate into CI/CD to automatically flag high-risk packages during pull requests or builds","Triage a suspected compromised package by scanning it locally to understand its capabilities and threat indicators","Verify the security posture of third-party packages before adding them to a monorepo or internal registry","Generate SARIF reports for integration with security dashboards or SIEM systems like Datadog"],"what_it_does":"GuardDog is a static analysis tool that downloads and scans open source packages across multiple ecosystems (PyPI, npm, Go, Rust, RubyGems, GitHub Actions, VSCode extensions) to detect supply chain attacks. Rather than flagging every suspicious pattern independently, it uses a risk-correlation model: it identifies both code capabilities (what the package can do, like network access) and threat indicators (suspicious domains, obfuscation), then flags actual risks only when both appear in the same file or across related files. This reduces alert fatigue by distinguishing between legitimate functionality and genuine malicious intent.\n\nThe tool runs YARA rules against package source code and analyzes metadata to score packages on a 0-10 risk scale based on attack chain completeness, specificity, and sophistication. Scans execute inside a kernel-level sandbox (Landlock on Linux, Seatbelt on macOS) to prevent malicious code from executing during extraction or analysis. It supports scanning remote packages, local archives, directories, and S3 buckets, with output in JSON or SARIF format for CI/CD integration.","worth_installing":"Yes. GuardDog is actively maintained, has no known vulnerabilities, and fills a specific gap in supply chain security by correlating code capabilities with threat indicators rather than generating false-positive noise. The sandboxed scanning protects against execution during analysis. Install it if you need to audit dependencies across multiple package ecosystems or integrate package security checks into CI/CD; skip it if you only use a single ecosystem and already have ecosystem-specific tooling."},"id":"guarddog","links":{"html":"https://skillfed.io/packages/guarddog","md":"https://skillfed.io/packages/guarddog.md","pypi":"https://pypi.org/project/guarddog/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-08-12","license_spdx":null,"license_treatment":"permissive","name":"guarddog","python_support":"supports_current","summary":"GuardDog is a CLI tool for identifying malicious open source packages"},"popularity":{"monthly_downloads":157816,"position":10744,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"3.2.0"}