Purpose-built for M&A due diligence. Open source risk belongs in the financial model, not an IT footnote.
Most years cost nothing. The year that doesn’t can cost millions. Here’s your exposure at each company size.
They check for known vulnerabilities. You need to know what this target’s open source supply chain will cost you.
Black Duck 2025 OSSRA, Sharma (2023)
These are the capabilities required for acquisition due diligence. Developer security tools were never designed to provide them.
| Capability | OSS Risk Guard | Socket | Snyk | Black Duck | Sonatype (Nexus) | Endor Labs |
|---|---|---|---|---|---|---|
| Bonded Reports | ✓ | — | — | — | — | — |
| Dollar-Value Risk Quantification | ✓ | — | — | — | — | — |
| M&A Due Diligence Reports | ✓ | — | — | ✓ | — | — |
Risk Guard is not a replacement for your development security tools. It's the M&A layer that sits on top of them.
77 real-world supply chain incidents, tested against every major tool. Here’s who would have caught them.
Every bar above is backed by the 77 incidents below. See methodology →
These aren’t hypotheticals. Every row is a documented incident with an estimated financial impact and a verdict for every tool. See methodology →
| Incident | Year | Est. Impact | Risk Guard | Socket | Snyk | Black Duck | Sonatype | Endor Labs |
|---|---|---|---|---|---|---|---|---|
| event-stream / flatmap-stream | 2018 | $1M+ crypto theft | Caught | Caught | Missed | Missed | Partial | Missed |
| ua-parser-js hijack | 2021 | Tens of millions | Caught | Caught | Missed | Missed | Caught | Missed |
| eslint-scope | 2018 | $500K-2M | Caught | Caught | Missed | Missed | Caught | Missed |
| coa and rc packages | 2021 | $5-15M | Caught | Caught | Missed | Missed | Caught | Missed |
| rest-client gem | 2019 | $1-5M | Caught | Caught | Missed | Missed | Missed | Missed |
| bootstrap-sass gem | 2019 | $1-5M | Caught | Caught | Missed | Missed | Missed | Missed |
| chalk/debug Shai-Hulud phishing | 2025 | $10-50M+ | Caught | Caught | Missed | Missed | Partial | Missed |
| @solana/web3.js | 2024 | $160K+ confirmed stolen | Caught | Caught | Missed | Missed | Partial | Missed |
| Rspack and Vant | 2024 | $500K-2M | Caught | Caught | Missed | Missed | Caught | Missed |
| ctx package (PyPI) | 2022 | 27K malicious downloads | Caught | Caught | Missed | Missed | Missed | Missed |
| strong_password gem | 2019 | Limited (537 downloads) | Caught | Partial | Missed | Missed | Missed | Missed |
| XZ Utils backdoor (CVE-2024-3094) | 2024 | $10-50M+ (potential hundreds of billions) | Caught | Missed | Missed | Missed | Missed | Partial |
| aiocpa backdoor | 2024 | Limited (12K downloads) | Caught | Caught | Missed | Missed | Missed | Missed |
| colors.js / faker.js sabotage | 2022 | $10-50M+ | Caught | Partial | Missed | Missed | Partial | Missed |
| node-ipc / peacenotwar | 2022 | $5-25M | Caught | Caught | Missed | Missed | Caught | Missed |
| atomicwrites deletion | 2022 | Minimal | Partial | Missed | Missed | Missed | Missed | Missed |
| es5-ext / styled-components | 2022 | Minimal | Partial | Partial | Missed | Missed | Missed | Missed |
| left-pad removal | 2016 | $5-20M | Partial | Missed | Missed | Missed | Missed | Missed |
| Birsan dependency confusion | 2021 | $130K+ bug bounties | Caught | Caught | Missed | Missed | Caught | Missed |
| PyTorch torchtriton | 2022 | $5-20M | Caught | Caught | Missed | Missed | Caught | Missed |
| crossenv typosquatting | 2017 | Minimal (~50 installs) | Caught | Caught | Missed | Missed | Caught | Missed |
| jeIlyfish / python3-dateutil | 2019 | SSH/GPG key theft | Caught | Caught | Missed | Missed | Caught | Missed |
| colourama | 2018 | Bitcoin clipboard hijacking | Caught | Caught | Missed | Missed | Caught | Missed |
| 500+ PyPI typosquatting campaign | 2024 | PyPI suspended all registrations | Caught | Caught | Missed | Missed | Caught | Missed |
| 451-package PyPI crypto campaign | 2023 | Crypto clipboard theft | Caught | Caught | Missed | Missed | Caught | Missed |
| npm 287-package blockchain C2 | 2024 | Multi-platform malware | Caught | Caught | Missed | Missed | Partial | Missed |
| rustdecimal / CrateDepression | 2022 | <500 downloads | Caught | Caught | Missed | Missed | Missed | Missed |
| BoltDB Go typosquat | 2021 | 3+ years undetected | Caught | Caught | Missed | Missed | Missed | Missed |
| Maven Jackson typosquat | 2025 | First sophisticated Maven Central malware | Caught | Caught | Missed | Missed | Caught | Missed |
| @typescript_eslinter scope spoof | 2024 | Hundreds of daily downloads | Caught | Caught | Missed | Missed | Caught | Missed |
| NuGet malware campaigns | 2023-2025 | $10-100M+ if time bombs trigger | Caught | Caught | Missed | Missed | Caught | Missed |
| MUT-8694 cross-ecosystem | 2024 | External binary execution | Caught | Caught | Missed | Missed | Caught | Missed |
| 241 cryptominer typosquats | 2022 | Cryptomining losses | Caught | Caught | Missed | Missed | Caught | Missed |
| W4SP Stealer campaign | 2022-2023 | 5700+ downloads initial wave | Caught | Caught | Missed | Missed | Caught | Missed |
| ESET 116-package cluster | 2023 | 10K+ total downloads | Caught | Caught | Missed | Missed | Partial | Missed |
| Cool Package / pytoileur | 2023-2024 | Keylogging, webcam, screenshots | Caught | Caught | Missed | Missed | Partial | Missed |
| requesys ransomware | 2022 | File encryption on Windows | Caught | Caught | Missed | Missed | Caught | Missed |
| pymafka Cobalt Strike | 2022 | ~300 downloads | Caught | Caught | Missed | Missed | Caught | Missed |
| 2025 cloud credential theft | 2023-2025 | 14100+ cumulative downloads | Caught | Caught | Missed | Missed | Partial | Missed |
| JarkaStealer AI chatbot lure | 2023-2024 | 1700+ downloads across 30+ countries | Caught | Caught | Missed | Missed | Partial | Missed |
| Fortinet WS campaign | 2023-2024 | 2000+ estimated victims | Caught | Caught | Missed | Missed | Partial | Missed |
| getcookies backdoor chain | 2018 | 64K weekly downloads (mailparser) | Caught | Caught | Missed | Missed | Partial | Missed |
| RubyGems mass typosquatting | 2019-2025 | 600%+ increase 2020-2021 | Caught | Caught | Missed | Missed | Partial | Missed |
| Shai-Hulud npm worm | 2025 | $10-50M+; ~27% of cloud environments | Caught | Caught | Missed | Missed | Partial | Missed |
| Nx / s1ngularity | 2025 | 2349 secrets leaked; 5500+ repos made public | Caught | Caught | Missed | Missed | Partial | Missed |
| @0xengine/xmlrpc | 2023-2024 | 68 compromised systems | Partial | Partial | Missed | Missed | Missed | Missed |
| Codecov bash uploader | 2021 | $50-100M+ | Caught | Missed | Missed | Missed | Missed | Missed |
| SolarWinds / Sunburst | 2020 | $1B+ ecosystem | Partial | Missed | Missed | Missed | Missed | Missed |
| Ultralytics YOLO | 2024 | $5-10M | Caught | Caught | Missed | Missed | Partial | Missed |
| GhostAction campaign | 2025 | 3325 secrets exfiltrated | Partial | Missed | Missed | Missed | Missed | Missed |
| eslint-config-prettier | 2025 | 14K+ direct dependents | Caught | Caught | Missed | Missed | Partial | Missed |
| Polyfill.io domain takeover | 2024 | 100K+ websites injected | Partial | Missed | Missed | Missed | Missed | Missed |
| MavenGate | 2024 | $10-100M+ potential | Partial | Missed | Missed | Missed | Partial | Missed |
| Log4Shell (CVE-2021-44228) | 2021 | $5-17B+ | Caught | After damage | After damage | After damage | After damage | After damage |
| Heartbleed (CVE-2014-0160) | 2014 | $500M-2B+ | Caught | After damage | After damage | After damage | After damage | After damage |
| Spring4Shell (CVE-2022-22965) | 2022 | $50-200M | Caught | After damage | After damage | After damage | After damage | After damage |
| Text4Shell (CVE-2022-42889) | 2022 | Active scanning | Caught | After damage | After damage | After damage | After damage | After damage |
| Lodash prototype pollution | 2018-2020 | Virtually every Node.js app | Caught | After damage | After damage | After damage | After damage | After damage |
| PAC-Resolver SSRF/RCE | 2021 | AWS CDK, Firebase CLI affected | Caught | After damage | After damage | After damage | After damage | After damage |
| node-netmask SSRF | 2021 | 278K dependent repos | Caught | After damage | After damage | After damage | After damage | After damage |
| Equifax / Apache Struts | 2017 | $1.38B+ documented; up to $10B | Caught | After damage | After damage | After damage | After damage | After damage |
| ShellShock / Bash | 2014 | $500M-1B+ | Caught | After damage | After damage | After damage | After damage | After damage |
| FSF v. Cisco/Linksys | 2008-2009 | Undisclosed settlement | Caught | Partial | Caught | Caught | Caught | Caught |
| Artifex v. Hancom | 2016-2017 | Confidential settlement | Caught | Partial | Caught | Caught | Caught | Caught |
| Entr'ouvert v. Orange | 2011-2024 | €900K+ judgment | Caught | Partial | Caught | Caught | Caught | Caught |
| SFC v. Vizio | 2021-ongoing | $2B+ company at risk | Caught | Partial | Caught | Caught | Caught | Caught |
| CoKinetic v. Panasonic Avionics | pending | $100M+ sought | Caught | Partial | Caught | Caught | Caught | Caught |
| BusyBox GPL enforcement | 2007-2013 | 14+ companies sued; $100K+ judgments | Caught | Partial | Caught | Caught | Caught | Caught |
| Hellwig/SFC v. AVM | 2023-2024 | Court ruled for plaintiff | Caught | Partial | Caught | Caught | Caught | Caught |
| Versata / XimpleWare | 2013-2015 | $300M sought; 5+ lawsuits | Caught | Partial | Caught | Caught | Caught | Caught |
| Tendermint GPL contamination | 2018 | Potential codebase contamination | Caught | Partial | Caught | Caught | Caught | Caught |
| Google AGPL ban | ongoing | Company-wide policy | Caught | Partial | Caught | Caught | Caught | Caught |
| AGPL $300K SaaS rewrite | 2025 | $300K + 3-month delay | Caught | Partial | Caught | Caught | Caught | Caught |
| Elastic license change | 2021 | Full backend rewrite | Caught | Missed | Missed | Missed | Missed | Missed |
| HashiCorp BSL change | 2023 | 140+ companies affected | Caught | Missed | Missed | Missed | Missed | Missed |
| Redis license change | 2024 | Community fragmentation | Caught | Missed | Missed | Missed | Missed | Missed |
| Black Duck OSSRA M&A audits | ongoing | 53-89% of M&A transactions have conflicts | Caught | Partial | Partial | Caught | Partial | Partial |
From subscription to report in five days.
Purchase a Risk Guard subscription. Continuous monitoring across your portfolio.
Scan day 1. Full report day 5. Executive summary, SBOM, license and maintainer health reports.
Expedited timelines available.
Backed by an E&O policy from Brown & Brown. If we miss a material risk, you have financial recourse through our carrier. The only supply chain vendor with insured findings.
Risk scores, deal impact, and key findings for leadership. The one-page brief that goes to the investment committee.
All dependencies with licenses, versions, and risk scores. Industry-standard format. Machine-readable and auditor-ready.
Conflict analysis, legal exposure, and remediation cost estimates. Covers copyleft propagation and dual-license traps.
Bus factor scores, abandonment risk, and sustainability analysis. The risks that only surface after close.
Founded by the team behind NumPy and Conda—two of the most widely-used open source projects in the world. We understand supply chain risk because we are the dependency graph.