AquilaX SCA scans every direct and transitive dependency against CVE DB, GHSA, and OSV — across all major package ecosystems. Detects vulnerable packages, license violations, and malicious supply-chain packages in seconds.
Most scanners check your direct dependencies. AquilaX SCA traces the full transitive dependency tree — where 78% of real vulnerabilities hide.
Real-time lookup against NVD, GitHub Security Advisory (GHSA), and OSV databases. CVSS scores, exploitability context, and PoC availability surfaced on every finding.
Full dependency tree resolution across all ecosystems. If your dependency's dependency has a critical CVE, AquilaX finds it and identifies the upgrade path to eliminate it.
Detect GPL, AGPL, LGPL, and other copyleft licenses that conflict with your commercial software. Custom license policy enforcement aligned to your legal team's requirements.
Typosquatting detection, dependency confusion attacks, packages with injected malicious code, and known malware packages identified across npm, PyPI, Maven, and NuGet.
Flag packages that are end-of-life, no longer receiving security patches, or significantly behind the latest stable release — before they become a liability.
Export a full Software Bill of Materials in SPDX or CycloneDX format. Required for NIST SSDF, US Executive Order 14028, and EU Cyber Resilience Act compliance.
AquilaX SCA supports all major package ecosystems — no configuration required.
Any team shipping software with open-source dependencies — which is every team.
Block vulnerable package versions at the CI/CD gate. Set CVSS thresholds and automatically fail builds that introduce critical or high severity vulnerabilities.
Enforce license policies automatically. Get notified when copyleft licenses enter your codebase before they create legal exposure. Generate SBOM for regulatory requirements.
Verify third-party software SBOMs before onboarding vendors. Continuously monitor your supply chain for newly disclosed vulnerabilities in already-shipped software.
Connect your repository and get a full SCA report in under 60 seconds. No agents. No configuration.