Phylum

Phylum is a software supply chain security company that helps organizations manage risks in open-source software.

It focuses on analyzing third-party code as soon as it is published, identifying malicious or risky packages, and supporting compliance and governance efforts. The Phylum platform automates software supply chain security by continuously monitoring open-source package publications across major ecosystems like npm, PyPI, and RubyGems. It offers automated risk analysis, policy enforcement to block unsafe packages, and real-time threat intelligence. Phylum also provides tools such as the Phylum CLI for pre-checking package findings and a GitHub App integration for monitoring repositories. Founded by veterans of the U.S. Intelligence Community, Phylum is designed for security professionals, engineering managers, and developers, particularly those working with mission-critical systems. The company positions itself as a leader in identifying and protecting against software supply chain attacks, addressing gaps left by traditional security tools.