{"slug": "ubel-free-sca-dependencies-linux-packages-docker-firewall-and-ai-assisted-sast", "title": "UBEL: Free SCA, dependencies/Linux packages/Docker firewall,and AI-assisted SAST", "summary": "UBEL, a free software composition analysis tool and install-blocking firewall, enforces security policies at install-time to block supply-chain attacks across dependencies, Linux packages, Docker, and AI agent runtimes. It resolves dependencies, generates PURLs, scans via OSV.dev and NVD, and supports ecosystems including Node.js, Python, PHP, Rust, Go, .NET, Java, and Ruby, as well as Linux distributions and Windows platforms.", "body_md": "Ubel resolves dependencies, generates PURLs, scans them through [OSV.dev](https://osv.dev) and [NVD](https://nvd.nist.gov/), and enforces configurable security policies at install-time to block supply-chain attacks before they reach production.\n\nUBEL is a **software composition analysis (SCA)** tool and **install-blocking firewall** built for developers and teams who care about what enters their supply chain at every layer. Unlike report-only scanners, UBEL enforces policy — if a scan fails, it blocks the operation and tells you exactly why.\n\nIt spans the entire delivery chain: from the moment a developer adds a dependency, through CI validation, to what is running on a deployment server or inside an AI agent's runtime environment.\n\n```\nubel/\n├── python/          # Python CLI — ubel-pip, ubel (Linux host scanner)\n├── node/            # Node.js CLI — ubel-npm, ubel-pnpm, ubel-bun, ubel-agent, ubel-platform\n└── vscode/          # VS Code extension — bundles the node/ engine at package time\n```\n\nThe VS Code extension imports the Node.js engine directly from `node/src/`\n\nat package time via the `prepackage`\n\nscript — no separate install step required when building locally.\n\n- Full dependency resolution with PURL generation across all supported ecosystems\n- Vulnerability scanning via batched queries to OSV.dev and NVD's APIs\n- Concurrent enrichment (CVSS, EPSS, fix recommendations, references) with up to 40 parallel threads\n- Policy engine — block/allow by severity threshold and unknown-severity packages\n- Malicious package detection (\n`MAL-*`\n\nadvisories) — always blocked regardless of policy `check`\n\nmode — dry-run resolution and scan with no side effects`install`\n\nmode — scan-gate before installation; blocks if policy violated`health`\n\nmode — scan the current project's installed dependencies- Full-stack monorepo scanning — all supported ecosystems in a single pass\n- Platform scanning — Linux (dpkg/apk/rpm) and Windows (registry/PowerShell), no elevated privileges required\n- Atomic lockfile revert with TOCTOU SHA-256 integrity protection (Node.js)\n- Automatic report generation: timestamped\n**JSON**+** HTML**+** SBOM**(`*.cdx.json`\n\n) +**SARIF**(`*.sarif.json`\n\n) per scan, plus`latest.*`\n\nconvenience links - Zero external runtime dependencies (stdlib only, in both Python and Node.js)\n- Complete, compliant, and enriched SBOM CycloneDX v1.6 with full dependency graph and vulnerabilities in VEX format\n- Complete, compliant, and enriched SARIF v2.1.0 output\n\n| Ecosystem | Package Manager | Resolved From |\n|---|---|---|\n| Node.js | npm, pnpm, yarn, bun | `node_modules/` (on-disk walk) |\n| Python | pip / virtualenv | `.dist-info` / `.egg-info` inside venv `site-packages/` |\n| PHP | Composer | `vendor/` |\n| Rust | Cargo | `Cargo.lock` |\n| Go | Go Modules | `go.sum` |\n| C# / .NET | NuGet | `packages.lock.json` / `obj/project.assets.json` |\n| Java / Kotlin | Maven | `pom.xml` resolved dependencies |\n| Ruby | Bundler | `Gemfile.lock` |\n\nEach discovered package is deduplicated by PURL before submission — packages shared across sub-projects are scanned exactly once.\n\n| Distribution | Package Manager | Source | PURL type |\n|---|---|---|---|\n| Ubuntu | dpkg | `/var/lib/dpkg/status` |\n`pkg:deb/ubuntu/` |\n| Debian | dpkg | `/var/lib/dpkg/status` |\n`pkg:deb/debian/` |\n| Alpine / Alpaquita | apk | `/lib/apk/db/installed` |\n`pkg:apk/alpine/` |\n| Red Hat / RHEL | rpm | `rpm -qa` |\n`pkg:rpm/redhat/` |\n| AlmaLinux | rpm | `rpm -qa` |\n`pkg:rpm/almalinux/` |\n| Rocky Linux | rpm | `rpm -qa` |\n`pkg:rpm/rocky-linux/` |\n| CentOS / Fedora | rpm | `rpm -qa` |\n`pkg:rpm/redhat/` |\n\nDetected via registry probes and PowerShell — no elevated privileges required.\n\n| Category | Components |\n|---|---|\n| Operating system | Windows 10 / 11 (build-accurate CPE version) |\n| Security | Windows Defender |\n| Runtimes | Node.js, Python, PHP, Go, Rust, Ruby, JRE, JDK |\n| .NET | All installed .NET Core / Desktop / ASP.NET runtimes (multi-version) |\n| Browsers | Chrome, Firefox, Microsoft Edge |\n| Developer tools | Git, Docker Desktop, VS Code, Cursor |\n| Shell | PowerShell |\n\nVulnerabilities are matched using CPE 2.3 identifiers against the CVE/NVD database.\n\n```\npip install ubel-python\n```\n\n| Binary | Purpose |\n|---|---|\n`ubel-pip` |\nPython / PyPI ecosystem (virtualenv scanning, dry-run installs) |\n`ubel` |\nLinux host OS package scanning (dpkg, apk, rpm) |\n\n**Requirements:** Python `>= 3.8`\n\n, `pip`\n\navailable in the target virtual environment.\n\nSee [ python/README.md](/AlaBouali/ubel/blob/main/python/README.md) for full documentation.\n\n```\nnpm install -g @arcane-spark/ubel-node\n```\n\n| Binary | Purpose |\n|---|---|\n`ubel-npm` |\nnpm ecosystem |\n`ubel-pnpm` |\npnpm ecosystem |\n`ubel-bun` |\nbun ecosystem |\n`ubel-agent` |\nAI agent workspace scan (OS, runtimes, tools, dependencies) |\n`ubel-platform` |\nHost platform scan (OS, runtimes, tools) |\n\n**Requirements:** Node.js `>= 18.0.0`\n\n, target package manager binary on `PATH`\n\n.\n\nyarndoes not support a lockfile-only dry-run —`yarn add`\n\nalways writes`node_modules`\n\n. UBEL supports yarn in`health`\n\nmode only and cannot provide install-blocking firewall coverage for it.\n\nSee [ node/README.md](/AlaBouali/ubel/blob/main/node/README.md) for full documentation.\n\n**From the Marketplace:**\n\n```\next install Arcane-Spark.ubel-vscode\n```\n\n**From VSIX:**\n\n- Download\n`ubel-vscode-extension.vsix`\n\nfrom the[releases page](https://github.com/AlaBouali/ubel/releases). - Open the Command Palette →\n**Extensions: Install from VSIX…** - Select the downloaded file.\n\n**Requirements:** Node.js `>= 18.0.0`\n\n, VS Code `^1.85.0`\n\n.\n\n| Command | Shortcut (Win/Linux) | Shortcut (Mac) | What it scans |\n|---|---|---|---|\n| UBEL: Scan Project | `Ctrl+Alt+U` |\n`Cmd+Alt+U` |\nAll ecosystems inside the open workspace folder |\n| UBEL: Scan Code Editor's Extensions | `Ctrl+Alt+X` |\n`Cmd+Alt+X` |\nnpm packages inside installed VS Code / Cursor extensions |\n| UBEL: Scan Host Platform | `Ctrl+Alt+P` |\n`Cmd+Alt+P` |\nSystem software installed on this machine |\n\nSee [ vscode/README.md](/AlaBouali/ubel/blob/main/vscode/README.md) for full documentation.\n\n`ubel-npm/pnpm/bun check`\n\nand `install`\n\ninvoke the package manager's lockfile-only flag, resolving the full dependency tree and writing a candidate lockfile without touching `node_modules/`\n\n. UBEL scans the candidate lockfile, then makes a binary decision:\n\n**Clean**— the candidate lockfile is accepted and the actual install proceeds.** Violation**— the lockfile is reverted to its pre-scan state from the disk backup.`node_modules/`\n\nis never touched.\n\nBefore any real install is allowed to proceed, SHA-256 digests of the candidate lockfile and `package.json`\n\nare re-verified to close the TOCTOU window between scan and install.\n\nAll three package managers are invoked with `--ignore-scripts`\n\nto block malicious pre/post install scripts.\n\nPolicy is stored as JSON at `.ubel/local/policy/config.json`\n\nrelative to the project root (Linux host scanner and the VS Code extension's host scan use `~/.ubel/`\n\n).\n\nDefault policy created on first run:\n\n```\n{\n    \"severity_threshold\": \"high\",\n    \"block_unknown_vulnerabilities\": true\n}\n```\n\n| Field | Values | Default | Behaviour |\n|---|---|---|---|\n`severity_threshold` |\n`low` `medium` `high` `critical` `none` |\n`high` |\nBlock packages at or above this severity |\n`block_unknown_vulnerabilities` |\n`true` `false` |\n`true` |\nBlock packages with CVEs but no CVSS score |\nInfections (`MAL-*` ) |\n— | always blocked | Cannot be toggled; unconditionally blocked |\n\nThe threshold is inclusive — `high`\n\nblocks both `high`\n\nand `critical`\n\n. Setting `none`\n\ndisables severity blocking but infections are still blocked.\n\nEvery scan writes files to a timestamped path and overwrites the `latest.*`\n\nconvenience links:\n\n```\n.ubel/reports/latest.json\n.ubel/reports/latest.html\n.ubel/reports/latest.cdx.json\n.ubel/reports/latest.sarif.json\n\n.ubel/local/reports/<ecosystem>/<mode>/<YYYY>/<MM>/<DD>/\n    <ecosystem>_<mode>_<engine>__<timestamp>.json\n    <ecosystem>_<mode>_<engine>__<timestamp>.html\n    <ecosystem>_<mode>_<engine>__<timestamp>.cdx.json\n    <ecosystem>_<mode>_<engine>__<timestamp>.sarif.json\n```\n\nThe HTML report is fully self-contained (no server required) and includes:\n\n- Dashboard with severity breakdown chart and policy decision\n- Searchable, filterable vulnerability table\n- Full inventory with state (safe / vulnerable / infected / undetermined)\n- Interactive force-directed dependency graph with vulnerable-subtree filter\n- Per-vulnerability detail modals (CVSS vector, fix recommendations, OSV/NVD references)\n- System and runtime metadata\n\nThe SBOM is a fully valid [CycloneDX v1.6](https://cyclonedx.org) document including all components, their dependency relationships, and enriched vulnerability data in VEX format. The SARIF output is a fully valid [SARIF v2.1.0](https://sarifweb.azurewebsites.net/) file with deterministic SHA-256 fingerprinting per finding.\n\nAll CLI commands exit non-zero on policy violations:\n\n```\n# GitHub Actions\n- name: UBEL dependency scan\n  run: ubel-npm check          # or ubel-pip check\n\n- name: UBEL firewall-gated install\n  run: ubel-npm install        # or ubel-pip install\n# Dockerfile\nRUN ubel-npm install\nRUN ubel-pip install\n```\n\nBoth engines expose a `main()`\n\nentry point for agents, CI tools, and the VS Code extension.\n\n**Node.js:**\n\n``` js\nimport { main } from \"@arcane-spark/ubel-node\";\n\nconst report = await main({\n  projectRoot : \"/abs/path/to/project\",\n  engine      : \"npm\",\n  mode        : \"health\",\n  is_script   : true,\n  save_reports: true,\n  scan_os     : false,\n  full_stack  : false,\n  scan_node   : true,\n  scan_scope  : \"repository\",   // repository | agent | developer_platform | editor_extension\n});\n```\n\n**Python:**\n\n``` python\nfrom ubel.__main__ import main\n\nreport = main({\n    \"project_root\": \"/abs/path/to/project\",\n    \"engine\":       \"pip\",\n    \"mode\":         \"health\",\n    \"packages\":     [],\n    \"is_script\":    True,\n    \"save_reports\": True,\n    \"scan_os\":      False,\n    \"full_stack\":   False,\n    \"scan_venv\":    True,\n    \"scan_scope\":   \"repository\",\n})\n```\n\nWhen called this way, the banner and interactive console output are suppressed. The return value is the same machine-readable report object written to disk.\n\nUBEL is fully local. The only external calls are to [osv.dev's public API](https://osv.dev/) and [NVD's API](https://nvd.nist.gov/), which receive package PURLs (name + version) to check for known vulnerabilities. No file contents, no dependency graphs, no machine identifiers, and no telemetry are sent anywhere.\n\nSee [LICENSE.md](/AlaBouali/ubel/blob/main/LICENSE.md) for details or contact [ala.bouali.1997@gmail.com](mailto:ala.bouali.1997@gmail.com) for commercial licensing.\n\n*Ubel — Secure every dependency, before it reaches production.*", "url": "https://wpnews.pro/news/ubel-free-sca-dependencies-linux-packages-docker-firewall-and-ai-assisted-sast", "canonical_source": "https://github.com/AlaBouali/ubel", "published_at": "2026-07-27 19:37:20+00:00", "updated_at": "2026-07-27 19:52:29.124967+00:00", "lang": "en", "topics": ["developer-tools", "ai-safety", "ai-infrastructure"], "entities": ["UBEL", "OSV.dev", "NVD", "CycloneDX", "SARIF"], "alternates": {"html": "https://wpnews.pro/news/ubel-free-sca-dependencies-linux-packages-docker-firewall-and-ai-assisted-sast", "markdown": "https://wpnews.pro/news/ubel-free-sca-dependencies-linux-packages-docker-firewall-and-ai-assisted-sast.md", "text": "https://wpnews.pro/news/ubel-free-sca-dependencies-linux-packages-docker-firewall-and-ai-assisted-sast.txt", "jsonld": "https://wpnews.pro/news/ubel-free-sca-dependencies-linux-packages-docker-firewall-and-ai-assisted-sast.jsonld"}}