Maintained, signed forks of abandoned open-source packages

keptsec takes npm and PyPI packages that are no longer maintained and still have open security advisories, fixes every open advisory, and publishes the result as a public, signed fork. The fix is offered upstream first.

What you get

Everything below is a file or an access right produced by our automated build, test and signing pipeline.

Free, for everyone:

• Public source for every fork, with a published diff against the last upstream version.
• Signed releases with build provenance (Sigstore and SLSA), published through registry trusted publishing. No long-lived publishing token is used.
• An OpenVEX statement and a CycloneDX SBOM for each release.
• An advisory record in OSV format for each release that links back to the original upstream advisory.
• A public attestation entry for each release: the sandbox re-run log, the upstream pull request, the diff, the test output, the provenance, the signature, the VEX files and the SBOM. See Attestations.

Paid plans for organisations add a signed evidence bundle for the whole catalog and a VEX feed for your organisation, kept current by the pipeline. The Org plan adds a VEX and remediation report for your own lockfile, pinned LTS branches and a private package registry. Checkout is not open yet. See Pricing.

How a release is made

1. Every open OSV and GHSA advisory for the package name is collected, not only the one scanners flag. A release closes all of them or it does not ship.
2. Each advisory is reproduced as a failing test in a sandbox with no network access.
3. The fix goes upstream first, as a pull request. We publish a fork only after upstream stays silent for 30 days or the project is archived.
4. The fix must turn those tests green, and the upstream test suite must pass unchanged.
5. The release is built and signed in CI from the same commit that the tests ran on. Its attestation entry is generated from that run's files.

Free to install

Every fork, and all the evidence for every release, is free. Paid plans for organisations add a catalog-wide evidence bundle, an organisation VEX feed and, on the Org plan, LTS branches and a private registry; see Pricing.

Status

No release has been published yet. The attestation index lists each release when it ships.

Questions, security reports and contact

• Questions about installing, migrating to or verifying a fork: ask in Q&A on GitHub Discussions. To suggest a package for us to look at, post in Ideas.
• Security problems in our forks, this site or our pipeline: please do not post them publicly. Report them privately with the “Report a vulnerability” button on the Security tab of the affected repository. If no single repository fits, use private vulnerability reporting on keptsec/.github. Without a GitHub account, email support@keptsec.com with a subject starting SECURITY.
• Billing and anything that should not be public: support@keptsec.com.
• Legal notices, takedown requests and personal data requests: legal@keptsec.com.

Replies in Discussions and to support@keptsec.com are written by AI agents and are marked as such.

Never post tokens, keys, passwords, order numbers or card details in an issue or discussion.