Packj

Flags malicious and vulnerable open-source dependencies in your software supply chain.

Desktopfreeglobal

Packj is a self-hosted software supply-chain security tool that flags malicious, vulnerable, or risky open-source dependencies in npm, PyPI, and RubyGems packages using static and dynamic analysis. It's built for DevSecOps teams who want to catch SolarWinds- and ESLint-style supply-chain attacks before a malicious dependency reaches production.

Website

Full match profile

Behind the summary, Matchbox keeps a richer profile of Packj - the signals our matcher actually reads to decide when to surface it. It stays private; claim the listing to see and control it.

Problem & pain-point mapping
Who we surface it to (audience fit)
What it's a strong alternative to
Trust & credibility signals

Claim Packj to unlock →

Try Matchbox with your own problem

Describe what is not working - we’ll show you whether Packj (or something else) actually fits.

Try a problem