[beny23]

I feel a bit conned by the headline, it would be better to say "verifying CA certs in images"

[pulsar256]

I was also a bit confused and expected something like grype -https://github.com/anchore/grype

[mirzap]

I was also expected something like this, but I didn't know for grype till now. Thanks! Is there anything similar to this for npm packages?

[ashishbijlani]

I built Packj https://github.com/ossillate-inc/packj to scan NPM/PyPI/Ruby packages for CVEs and malicious/risky attributes.