Freedom251 › Software Composition Analysis Software
OpenHack Supply Chain
What OpenHack Supply Chain is
OpenHack Supply Chain combines software composition analysis and supply chain intelligence to find vulnerable dependencies and identify malicious packages. It maps direct and transitive dependencies from manifests and lockfiles across connected repositories, and compares installed versions between repositories to surface drift. Its intelligence identifies and blocks malicious packages in npm and PyPI. For supported updates in those ecosystems, it can prepare a fix pull request for a team to review and merge. Dependency inventories can be exported as CycloneDX 1.5 JSON with package names, resolved versions, available license details, and dependency relationships. Reports include a risk summary, prioritized remediation plan, dependency and license context, time-to-fix metrics, and remediation evidence. The Free plan includes one project, five free PR reviews per month, one one-time full scan, basic SCA, and OpenHack CLI access. GitHub integration is included in that plan, with read-only repository access through authorized integrations. The product is available on the web or self-hosted; Enterprise pricing is custom.
Who it suits
It suits security reviewers and teams at startups or enterprises that need dependency visibility across repositories. Teams working with npm or PyPI can also use its malicious-package identification and supported fix pull requests.
What it does well
- Maps direct and transitive dependencies.
- Identifies and blocks malicious npm and PyPI packages.
- Exports inventories as CycloneDX 1.5 JSON.
- Free plan includes basic SCA and CLI access.
What to know first
- Free plan includes only one full scan, one-time.
- Free plan includes one project.
- Enterprise pricing is custom and not listed.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free (Pay as you go) | 1 project · 5 free PR reviews per month · 1 free full scan (one-time) · Basic SCA · OpenHack CLI access | Free |
| Enterprise | Custom pricing · Unlimited connected repositories, projects, and read-only users · Custom rates · Full security platform · Custom deployment options and dedicated support | On request |
As openhack.com lists them, read 11 Oct 2026. The maker's own page has the final word.
Verdict
OpenHack Supply Chain brings dependency mapping, ecosystem-specific package intelligence, and remediation reporting together. Its free scan and PR review allowances are limited, so review those caps against your repository needs.
Facts from OpenHack Supply Chain's own pages
- AI data handling
- OpenHack says customer data is not used to train, fine-tune, or improve AI models, and that inference is stateless with no input-data retention. · openhack.com, 11 Oct 2026
- Audit reports
- Supply chain reports include an executive risk summary, prioritized remediation plan, dependency and license context, time-to-fix metrics, and remediation evidence. · openhack.com, 11 Oct 2026
- Compliance
- The Trust Center lists HIPAA and GDPR as compliant, while SOC 2 Type I and ISO 27001 are in progress. · openhack.com, 11 Oct 2026
- Dependency mapping
- It maps direct and transitive dependencies from manifests and lockfiles across connected repositories. · openhack.com, 11 Oct 2026
- Fixes
- For supported npm and PyPI dependency updates, it can prepare a fix pull request for the team to review and merge. · openhack.com, 11 Oct 2026
- GitHub integration
- The Free plan includes GitHub integration, and the Trust Center says customer source code is accessed read-only through authorized GitHub integrations. · openhack.com, 11 Oct 2026
- Intended users
- The product page describes reports for security reviewers and enterprise buyers, while the pricing page presents plans for startups and enterprises. · openhack.com, 11 Oct 2026
- Malicious packages
- Its supply chain intelligence identifies and blocks malicious packages in npm and PyPI. · openhack.com, 11 Oct 2026
- Purpose
- OpenHack Supply Chain combines software composition analysis and supply chain intelligence to find vulnerable dependencies and identify malicious dependencies. · openhack.com, 11 Oct 2026
- SBOM
- It exports dependency inventories as CycloneDX 1.5 JSON, including package names, resolved versions, available license information, and dependency relationships. · openhack.com, 11 Oct 2026
- Security controls
- The Trust Center lists encryption at rest and in transit, encrypted database backups, multi-factor authentication, least-privilege access, and organization-scoped data access. · openhack.com, 11 Oct 2026
- Source-code handling
- OpenHack says code is downloaded temporarily for analysis and deleted after scan completion, and that it does not modify, fork, or retain repository copies. · openhack.com, 11 Oct 2026
- Support
- Enterprise pricing lists guided onboarding, dedicated customer success, a custom SLA, and priority phone and email support. · openhack.com, 11 Oct 2026
- Version drift
- It compares installed package versions across repositories to surface version drift and components needing attention. · openhack.com, 11 Oct 2026