CheckOps home

Tools directory

V

CheckOps

vet

vet by SafeDep is an Apache-2.0 open-source tool that finds malicious packages, known vulnerabilities, risky GitHub Actions workflows and lockfile tampering, with CEL policy as code.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

vet focuses on the code you did not write: dependencies, GitHub Actions workflows and AI agent configs. It checks each package against SafeDep Threat Intel, which analyses new package versions as registries publish them, to catch malicious packages.

It also reports known vulnerabilities with the fixed version, risky workflows (dangerous triggers, template injection, exposed secrets and unpinned actions), lockfile entries from untrusted registries and very fresh versions. Rules written in CEL decide when a scan fails. The README notes vet v2 is in alpha on a branch, while v1 on main remains the latest release.

The source code is at safedep/vet on GitHub under the Apache-2.0 licence, with about 1,100 stars; the most recent commit was on 8 November 2026.

Features

  1. Malicious package detection: SafeDep Threat Intel.
  2. Vulnerability fixes: Upgrade guidance.
  3. Workflow checks: GitHub Actions risks.
  4. Lockfile tampering: Untrusted registries and fresh versions.
  5. CEL policies: Policy as code.

Pros

  1. Free for individuals: SafeDep cloud free forever for individual use.
  2. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
  3. Actively maintained: The repository had commits as recent as 8 November 2026.

Cons

  1. v2 transition: Alpha branch alongside v1.
  2. Threat intel dependency: Best results with SafeDep data.
vet scan --fail-on high                         # exit 1 on a high or critical finding
vet scan --base-ref origin/main --fail-on high  # report only what a pull request changes

Add CEL rules for anything more specific.

Resources:

Pricing

Prices were not listed on the website when checked on 11 November 2026; contact the vendor for plans.

  1. Teams worried about npm and PyPI supply-chain attacks.

Conclusion

vet adds malicious-package and workflow checks that classic SCA tools miss.

Gate CI with a simple CEL policy first.

On CheckOps, vet is filed under the Security testing and Release & CI gates stages. Related tools listed here include Socket, OSV-Scanner, Snyk, Dependency-Check, zizmor and Endor Labs. When comparing them, weigh the licence, the languages and platforms each supports, whether it is self-hosted or managed, and how cleanly it slots into your existing CI pipeline. Details on this page were checked against the official website, documentation and repository on 11 November 2026.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with vet side by side.