Eclipse Steady vs Twira Dependency Vulnerabilities

Eclipse Steady is an open-source tool for analyzing Java and Python applications that depend on open-source components with known vulnerabilities. It combines static and dynamic analysis to determine whether vulnerable code is reachable or executed in an application context, using a code-focused, usage-based assessment rather than metadata alone. The project includes Java and Python client tools, server-side REST services, and web frontends. Documentation covers Java scans for Maven, Gradle, and command-line workflows, plus Python command-line scanning. Jenkins and other continuous-integration systems can automate scans. Java Maven reports can be written as HTML, XML, or JSON. Its backend runs as a Docker Compose application during scans, storing vulnerability information and results. Initial setup processes code-level vulnerability data, followed by daily delta updates. Eclipse Steady is free under Apache License 2.0; version 3.2.5 is labeled an Incubator Project.

Twira Dependency Vulnerabilities scans software lockfiles for known vulnerabilities and filters findings based on whether packages are installed and imported by code. It checks npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, and Swift Package Manager lockfiles against OSV data, which aggregates GHSA, RustSec, PYSEC, the Go vulnerability database, and other feeds. Findings are available as structured JSON or SARIF 2.1.0. After an initial sync, a local vulnerability-data cache with a 24-hour time-to-live supports offline and air-gapped scans. Accepted-risk suppressions persist through lockfile changes, and detections are recorded in an append-only Merkle audit chain. The same binary can run on a laptop, CI runner, or in an air-gapped environment. Twira says indexing runs locally and indexed content is not telemetered; LLM calls use the customer’s chosen provider and key. The free plan does not list SCA. Pro costs $29.99 a month and includes a free 14-day trial. Twira says the scanner covers application dependencies and known vulnerabilities, not novel malware or several other attack types.