You can now see every open source package your services load in one list, with its license, installed version and known vulnerabilities. The new library catalog in Atatus Application Security builds this list from the APM agents you already run in your Node.js, Python and PHP services.
Use it to find outdated packages, spot licenses that need a legal review and see which services run a vulnerable version before you plan an upgrade.
What the catalog shows
- License: The license of each package, such as MIT or Apache-2.0, so you can check it against your licensing rules.
- Vulnerabilities: The known security vulnerabilities in each package, grouped by severity, so you know which ones to deal with first.
- Current version: The installed version of each package, marked Latest or Outdated, so you can see when an update is due.
- Services: Every service that loads the package, with its environment.
- OpenSSF score: A security and health rating for each package from the Open Source Security Foundation (OpenSSF), which checks how closely an open source project follows security best practices.