macaron

Macaron is a software supply chain security analysis tool developed by Oracle Labs, designed to verify the build integrity of software artifacts and their dependencies across various ecosystems such as PyPI and npm. Notable features include attestation verification for provenance validation, detection of malicious packages, identification of vulnerable GitHub Actions, and support for reproducible builds through static analysis of build scripts, enhancing the security and traceability of software development workflows.