Safeguard Gold Directory: Free Open Source Package and CVE Lookup

Developers make dependency decisions in seconds, usually with nothing in front of them but a download count. Safeguard Gold Open Source exists to put real evidence in that moment, and it is free. It is a public directory covering packages across more than twenty ecosystems, and for each one it shows known vulnerabilities with CVE and CWE identifiers, presence in the CISA Known Exploited Vulnerabilities catalog, EPSS exploit probability, malware and typosquat signals, and MITRE ATT&CK mappings. The directory goes beyond packages. It also covers AI models, MCP servers and agent skills, which are now part of the same supply chain and are rarely checked with the same rigour as a library. Zero-day advisories discovered by Safeguard research are published here as SGZ identifiers, so a finding can reach you before a public CVE exists for it. Intelligence is refreshed continuously rather than published once, so a package that looked clean last month is re-evaluated as new advisories and malware signals arrive. Access is designed to fit where the decision happens. There is a free read API, a Chrome extension that surfaces the same intelligence on package pages you already browse, and a free CI gate so a build can fail on a package the directory flags. Nothing about this tier requires a paid Safeguard subscription. Gold Open Source is the free front door to the wider Safeguard platform. The Gold Registry adds hardened, zero-CVE, zero-malware, SLSA-signed drop-in artifacts for teams that want to start clean rather than patch later, and Safeguard ESSCM, OSM, TPRM, Portal and Compliance cover the full life cycle of the software supply chain with continuous scanning, software composition analysis, static and dynamic application security testing, reachability analysis and autonomous remediation. You can use the directory on its own for as long as you like.