Don't let your workflows work against you.
PurpleLotus finds business logic flaws and multi-step vulnerabilities that traditional tools miss — without drowning you in noise. Built for open source teams who ship fast and can't look away.
Backed by Expertise — researchers, advisors & allies
Modern software is assembled, not written. Every package you pull is a door you're leaving ajar. Traditional scanners see the doors — PurpleLotus sees who's walking through them and how they chain attacks together.
We find business logic flaws and multi-step vulnerabilities that automated tools fundamentally cannot detect. The kind that turn a low-severity misconfiguration into a full supply chain compromise.
Our researchers have been there. They've exploited the same classes of bugs in production at scale. That experience is why Microsoft and GitHub trust us enough to list us in their halls of fame.
"Because breaches aren't an option. Don't let your workflows work against you."
Pulled automatically from the GitHub Advisory Database — real advisories affecting npm, PyPI, Go, RubyGems, Maven, crates.io and GitHub Actions, updated daily. No LLM in the loop: names and version ranges come straight from the advisory record.
| Package | Ecosystem | Affected | Patched | Severity | Advisory |
|---|---|---|---|---|---|
| Fetching latest advisories… | |||||
These results are sourced from the public web — specifically the GitHub Advisory Database — and are surfaced here automatically without manual verification by PurpleLotus. Advisory data can be incomplete, disputed, or updated after this page was generated. Always confirm affected/patched versions against the linked upstream advisory before taking action on your own systems.
Protect your GitHub CI/CD pipelines with real-time threat detection, automated security checks, and robust access controls for a secure software lifecycle. PurpleLotus integrates directly into your pull request workflow — no dashboard-switching, no alert fatigue.
We scan for dependency confusion, typosquatting, malicious package injections, secrets leakage, and pipeline privilege escalation — the exact vectors attackers use to poison open source at the source.
The 2020 SolarWinds attack inserted malicious code into a software update, impacting thousands of organisations including US government agencies. Attackers didn't break in — they were invited through a poisoned build pipeline.
SecureCI/CD is engineered specifically to detect and block this class of supply chain attack before your update ships to users.
Real-time scanning for dependency confusion, typosquatting, and malicious package injections across npm, PyPI, Maven and Go modules at every PR.
Monitors GitHub Actions workflows for secrets exposure, permission escalation, and unpinned third-party actions across your entire organisation.
Automated PR comments with reproduction steps, fix suggestions and severity scoring — so developers act without ever leaving GitHub.
Get started with Osprey in seconds. One command installs everything you need.
curl -fsSL https://purplelotus.space/install.sh | bash
Requirements: Node.js v14+, npm, git
Simulate attacks to uncover network vulnerabilities. We go beyond automated checklists to find the chained multi-step paths adversaries actually exploit in the real world.
Test web and mobile apps for security flaws — business logic bypasses, authentication weaknesses, and deep injection vulnerabilities that scanners consistently miss.
Assess susceptibility to phishing and social attacks with realistic simulation campaigns that surface your human attack surface before adversaries find it first.