Dark-Moon
Autonomous AI penetration testing platform that exercises running web, API, Active Directory and Kubernetes targets with proof of exploitation
Changes since last week
no change.
Known vulnerabilities
No dependencies were found in the scanned manifests, so there was nothing to match advisories against. This is not a clean result.
Second opinion: OSV-Scanner
OSV-Scanner found 0 advisories in the same files; 0 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.
Release integrity
Verdict: no release files.
- Checksums file: no
- Signatures: no
- SLSA provenance: no
- SBOM published with the release: no
Verified means a signature, provenance, or attestation was checked against an identity in ASCIT31/Dark-Moon's own GitHub Actions workflows.
Repository security (OpenSSF Scorecard)
Score 3.8/10, assessed 2026-11-01 (Scorecard CLI run by this workflow, carried forward from an earlier week). Scorecard viewer
All checks
| Check | Score | Reason |
|---|---|---|
| Branch-Protection | 0 | branch protection not enabled on development/release branches |
| CI-Tests | 0 | 0 out of 5 merged PRs checked by a CI test -- score normalized to 0 |
| CII-Best-Practices | 0 | no effort to earn an OpenSSF best practices badge detected |
| Dependency-Update-Tool | 0 | no update tool detected |
| Fuzzing | 0 | project is not fuzzed |
| Pinned-Dependencies | 0 | dependency not pinned by hash detected -- score normalized to 0 |
| SAST | 0 | SAST tool is not run on all commits -- score normalized to 0 |
| Token-Permissions | 0 | detected GitHub workflow tokens with excessive permissions |
| Vulnerabilities | 0 | 23 existing vulnerabilities detected |
| Code-Review | 1 | Found 3/25 approved changesets -- score normalized to 1 |
| Contributors | 6 | project has 2 contributing companies or organizations -- score normalized to 6 |
| Binary-Artifacts | 10 | no binaries found in the repo |
| Dangerous-Workflow | 10 | no dangerous workflow patterns detected |
| License | 10 | license file detected |
| Maintained | 10 | 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 |
| Security-Policy | 10 | security policy file detected |
| Packaging | — | packaging workflow not detected |
| Signed-Releases | — | no releases found |
GitHub Actions workflow audit (zizmor)
No medium- or high-confidence issues in 0 workflow files.
Dependencies
No dependencies were found in the scanned manifests.
History
| Week | Version | Dependencies | Critical | High | Medium | Low | Unknown | Changes |
|---|---|---|---|---|---|---|---|---|
| 2026-11-02 | v1.6.0 | 0 | 0 | 0 | 0 | 0 | 0 | — |
| 2026-11-01 | v1.6.0 | 0 | 0 | 0 | 0 | 0 | 0 | — |
Evidence
Downloads for this week: CycloneDX SBOM · Grype report
Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/ASCIT31__Dark-Moon/.
1 manifests and lockfiles scanned
mcp/requirements.txt
Full JSON for this project · Atom feed of weekly changes
Badges
shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.
[](https://rezmoss.github.io/awesome-security-pipeline/projects/ASCIT31/Dark-Moon/index.html)How this report is made
Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.
| Tool | What it does here | Version this week |
|---|---|---|
| Syft | Generates a CycloneDX SBOM from each release's manifests and lockfiles. | 1.55.0 |
| Grype | Matches the SBOM against known vulnerabilities. | 0.121.0 |
| OSV-Scanner | Checks the same files against the OSV database to confirm or add matches. | 2.7.0 |
| govulncheck | For Go tools, finds which advisories have vulnerable code compiled into the released Linux binary. | 1.9.0 |
| zizmor | Audits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions. | 1.31.1 |
| OpenSSF Scorecard | Scores repository security practices such as code review, branch protection, and pinned dependencies. | 5.6.0 |
| Cosign | Verifies Sigstore signatures on the release binary or its checksums file. | 3.1.4 |
| slsa-verifier | Verifies SLSA build provenance published with the release. | 2.7.1 |
| GitHub CLI attestations | Verifies GitHub artifact attestations for the release binary. | — |
| sbomlyze | Diffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer. | 0.6.0 |