Loading SOVA...
Loading SOVA...
SOVA (Supply Chain Orchestration & Visualization Assistant) is an open-source CLI tool by SecureNexus that extracts dependency information from software projects without ever reading source code.
SOVA scans your project's package manifest files (e.g., package.json, requirements.txt, Cargo.toml) and lock files to produce a structured JSON manifest. That manifest is then uploaded to SecureNexus for SBOM generation and vulnerability analysis.
sova-manifest.json — a structured file ready for SecureNexus ingestionSOVA walks your project directory (up to a configurable depth) and identifies dependency files by filename pattern.
Each file is parsed by the matching language parser. Only package names and versions are extracted.
Each manifest and lock file is scanned for known supply chain attack patterns.
A single sova-manifest.json is written with all dependency data and security findings.
Important: SOVA never reads .js, .py, .rs, or any other source file. It touches only files that describe dependencies.
JavaScript, Python, Java, Rust, Go, PHP, Ruby, Dart, Swift, .NET, Docker, Terraform, Elixir, Scala, C/C++, Haskell, Perl, R, Julia, Erlang, OCaml, HTML, Cocoa, Haxe, GitHub Actions, and more.
Detects install scripts, native code, dependency confusion, obfuscation, hardcoded secrets, and other supply chain attack patterns — directly from manifest files.
SOVA reads only package manifests and lock files. Your application source code is never scanned, uploaded, or transmitted.
Outputs a structured JSON manifest compatible with SecureNexus SBOM generation. Supports lock-file-based transitive dependency resolution.
Performing SBOM generation and software composition analysis (SCA).
Integrating dependency auditing into CI/CD pipelines.
Who want a quick snapshot of what their project depends on.
$ npm install -g @securenexus/sova
$ sova scan --path .
✓ Manifest saved to sova-manifest.json
Guide
Install via npm, run your first scan, understand the output.
All 27 language ecosystems with manifest and lock files.
All commands, flags, options, and exit codes.
Complete schema for sova-manifest.json.
Scan → upload manifest → get full CycloneDX SBOM.
Security
Contributing
Technical