Integrate Phylum with Vulnetix. Use the Phylum CLI and REST API to analyse dependencies for malware, suspicious behaviour, and supply chain risks, then export findings to Vulnetix.
Run Phylum in CI
Scan on every push and upload the report as a workflow artifact:
- name: Phylum analysis
uses: phylum-dev/phylum-analyze-pr-action@main
with:
phylum_token: ${{ secrets.PHYLUM_TOKEN }}
lockfiles: 'package-lock.json'
- name: Export findings
run: phylum analyze package-lock.json --format json > phylum-analysis.json
- name: Upload to Vulnetix
run: vulnetix upload --file phylum-analysis.json
How Vulnetix compares: better together
Vulnetix does not replace Phylum. Keep running it. Vulnetix sits on top of Phylum (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Phylum is strongest at its core category and also carries features in License Compliance, just as Vulnetix spans categories.
| Capability | Vulnetix | Phylum |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✓ Analyses dependency/lockfiles for known vulnerabilities alongside malicious-code risk |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ~ Default policy and OPA rules can flag/block copyleft or undesirable licenses as a risk domain |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✓ Core: real-time malicious-package detection across 7 ecosystems via static analysis/heuristics/ML |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Phylum does well
- Real-time analysis of every package published across seven ecosystems (npm, PyPI, RubyGems, NuGet, crates.io, Go, Maven) using static analysis, heuristics and ML to surface malicious packages before curated advisories exist
- Strong original malware research: typosquat, obfuscated-payload, install-script and dependency-confusion campaign detection, with a track record of publicly disclosed npm/PyPI attacks
- Phylum Sandbox (Birdcage) quarantines and analyses packages at install time, blocking malicious code during dependency resolution
- OPA-based policy engine lets teams write granular custom block rules across five risk domains (vulnerabilities, license misuse, malware, author risk, engineering risk) enforced in CI/CD
Where Vulnetix adds to it: Phylum is a deep supply-chain/malware analysis engine focused on the open-source package layer. Vulnetix complements it: its own malware + install-time package firewall (25+ registries, 12 policies) covers similar ground, while Vulnetix additionally spans SAST/IaC/container/secrets/cloud and consolidates everything (including ingested Phylum-style findings) into one deduplicated, exploit-intel-prioritised queue with versioned VEX, reachability and autofix. Better together: Phylum for package-origin depth, Vulnetix for cross-scanner orchestration.
No migration, no rip-and-replace. Phylum keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Phylum results in Vulnetix
Upload Phylum JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.