Scan Your AI Supply Chain
For Hidden Risks
Your AI stack is only as secure as its weakest dependency. Sekurely scans packages, models, and third-party AI components for CVEs, malicious code, and provenance risks.
Try Supply Chain Scanner — Live Demo
Authenticated Tool — Available on Growth Plan
Supply Chain scanning requires API access and dependency analysis. Available to authenticated users on Growth plan and above.
View Pricing →How Supply Chain Scanner Works
Submit Your Dependencies
Paste your requirements.txt, package.json, or model manifest. Sekurely parses every dependency and model reference.
Deep Risk Analysis
Each package and model is checked against CVE databases, malicious package registries, and model provenance records.
Get Risk Report
Receive a prioritized report with severity ratings, CVE references, affected versions, and specific remediation steps.
What Supply Chain Scanner Detects
Known CVEs
Matches every dependency against the NVD and OSV databases for known vulnerabilities with CVSS severity scores.
Malicious Packages
Detects typosquatting, dependency confusion, and known malicious packages that mimic legitimate AI libraries.
Model Provenance
Verifies model hashes and training source metadata to detect tampered or untrusted pre-trained models.
Outdated Dependencies
Flags packages with security patches available and calculates the risk exposure of running outdated versions.
Backdoor Indicators
Scans model weights and package code for known backdoor signatures and suspicious behavior patterns.
Transitive Risks
Analyzes indirect dependencies — the packages your packages depend on — where most supply chain attacks hide.
Frequently Asked Questions
What is AI supply chain risk?
AI supply chain risk refers to vulnerabilities introduced through third-party AI packages, pre-trained models, datasets, and dependencies. A compromised model or package can introduce backdoors, data leakage, or adversarial behavior into your AI system.
What does the Supply Chain Scanner check?
It scans your AI dependencies, model sources, and package versions for known CVEs, malicious packages, outdated libraries, and untrusted model origins — giving you a full risk report with remediation steps.
Which package ecosystems are supported?
Sekurely supports Python (pip), JavaScript (npm), and model registries including HuggingFace Hub, PyPI, and custom model sources.
How does model provenance work?
Model provenance tracks where a model came from, who trained it, and whether it has been tampered with. Sekurely checks model hashes, training source metadata, and known malicious model indicators.
Does this comply with NIST AI RMF?
Yes. Supply Chain Scanner addresses NIST AI RMF GOVERN 1.7 (supply chain risk management) and MANAGE 2.4 (third-party AI risk), helping you demonstrate compliance to auditors.
Explore More Sekurely Tools
Secure Your AI Supply Chain Today
One vulnerable dependency can compromise your entire AI stack. Do not wait for an incident.
Start Free — No Credit Card →