UBEL: free SCA tool blocks supply-chain attacks at install time

UBEL (Unified Bill / Enforced Law) is a free, open-source software composition analysis tool built to block supply-chain attacks before they reach production. Unlike traditional report-only scanners, UBEL acts as a firewall: it resolves dependencies, generates PURLs (Package URLs), scans them against OSV.dev and NVD vulnerability databases, and enforces configurable security policies at install time. If a scan fails, the operation is blocked and the user is told exactly why.

The tool spans three deployment layers. First, it integrates directly into development workflows through a Node.js CLI (ubel-npm, ubel-pnpm, ubel-bun, ubel-agent, ubel-platform), a Python CLI (ubel-pip, ubel), and a VS Code extension that bundles the Node.js engine. Second, it supports eight programming-language ecosystems: Node.js, Python, PHP, Rust, Go, C#/.NET, Java/Kotlin, and Ruby. Third, it scans system packages on Linux (dpkg on Ubuntu/Debian, apk on Alpine, rpm on RHEL/AlmaLinux/Rocky/CentOS/Fedora) and Windows (via registry and PowerShell, without requiring elevated privileges). This multi-ecosystem reach makes UBEL suitable for full-stack scans in monorepos and containerized environments.

UBEL's core firewall mechanics work as follows: in install mode, the tool invokes the package manager's lockfile-only flag to resolve the full dependency tree without touching node_modules/. UBEL then scans the candidate lockfile, matching packages by PURL against vulnerability databases and enriching findings with CVSS scores, EPSS ratings, fix recommendations, and references via up to 40 parallel threads. The policy engine evaluates each package against two configurable rules: a severity threshold (defaulting to 'high', which blocks packages at 'high' or 'critical' severity) and a flag to block unknown-severity packages (enabled by default). Packages flagged with MAL-* (malicious) advisories are always blocked, regardless of policy settings. If any package violates the policy or is malicious, UBEL reverts the lockfile to its pre-scan state from a disk backup and blocks the install. To close the time-of-check to time-of-use (TOCTOU) window, UBEL re-verifies SHA-256 digests of the candidate lockfile and package.json before the actual install proceeds. All package managers are invoked with --ignore-scripts to prevent malicious pre/post install scripts from running.

Every scan generates reports in four formats: JSON, HTML (fully self-contained, queryable with no server required), CycloneDX v1.6 SBOM (including full dependency graph and VEX-format vulnerability data), and SARIF v2.1.0 (with deterministic SHA-256 fingerprinting per finding). Reports are written to a timestamped path and convenience links (latest.json, latest.html, latest.cdx.json, latest.sarif.json) are overwritten. The HTML dashboard shows a severity breakdown chart, a searchable vulnerability table, full inventory with per-package state (safe, vulnerable, infected, or undetermined), an interactive force-directed dependency graph filterable by vulnerable subtrees, and system/runtime metadata. UBEL runs entirely locally; the only external calls are to osv.dev and NVD's public APIs, which receive only package names and versions. No file contents, dependency graphs, machine identifiers, or telemetry leave the machine. For CI/CD integration, all CLI commands exit non-zero on policy violations, allowing GitHub Actions workflows and Dockerfiles to enforce security gates. Both the Node.js and Python engines expose a main() entry point for programmatic use by AI agents, CI tools, and the VS Code extension, returning machine-readable report objects when called this way.

UBEL addresses a gap in traditional software supply-chain security: detection alone is insufficient if malicious or vulnerable packages reach production before a violation is caught. By running at install time—whether through the CLI, CI/CD pipeline, or VS Code extension—UBEL enforces policy before dependencies are written to disk. This approach aligns with the principle of failing fast and safely: if a scan detects a policy violation or malicious package, the operation is blocked and the lockfile is reverted atomically, backed by SHA-256 integrity checks to close the window between scan and install.

The tool's breadth is notable. Rather than focusing on a single ecosystem (e.g., Node.js or Python), UBEL spans eight language ecosystems plus system-level packages on multiple Linux distributions and Windows. This full-stack coverage is particularly relevant for containerized and multi-language environments—a developer working with both Node.js dependencies and Alpine Linux system packages in Docker can use a single policy and reporting framework. The concurrent enrichment of up to 40 parallel threads means scan latency scales gracefully with dependency count.

No comments yet. Be the first to share your thoughts!