50-Hop Dependency Trees. 3 Minutes. Not 3 Hours.
Vendex indexes 10M+ packages across every major registry and resolves complete transitive dependency chains at cuGraph speed. Malicious code, typosquatting, and supply chain backdoors get caught before your CI/CD gate closes.
Packages indexed across registries
Faster dependency resolution on GPU
Malicious package detection recall
Full 50-hop analysis (vs 3hr on CPU)
Every Dependency. Every Hop. Every Threat.
No existing SCA tool uses GPU acceleration. Vendex's cuGraph transitive resolution at 10M-package scale delivers a 60x performance advantage and enables real-time security gates without slowing developer velocity.
CUDA Dependency Graph Construction
CUDA parallel primitives ingest and index package manifests from npm, PyPI, Maven, NuGet, Go modules, and Docker Hub simultaneously. What CPU tools process sequentially, Vendex does in parallel.
cuGraph Transitive Resolution
GPU-accelerated BFS and DFS traversal resolves complete transitive dependency closures to 50+ hop depth. A 3-hour CPU analysis on enterprise-scale SBOMs completes in under 3 minutes.
TensorRT Malicious Code Detection
Deep learning classifiers, trained on millions of package samples, identify obfuscation, unauthorized network calls, and code patterns matching known supply chain attack families — at 97%+ recall with under 0.1% false positives.
Typosquatting Detection
Fuzzy name matching catches homoglyph attacks, character substitutions, and newly registered packages mimicking legitimate libraries. Maintainer reputation scoring adds a second layer of confidence.
SBOM Generation
Automated CycloneDX and SPDX SBOM generation with NVD, GitHub Security Advisories, and OSV vulnerability correlation. License compliance checking included. Continuous monitoring updates the SBOM as new CVEs publish.
NIM Alert Agent
When a package scores high-risk, a NIM agent autonomously investigates maintainer history, version velocity, download patterns, and code similarity before recommending block, warn, or allow — no analyst required.
Full-Depth Scan Before the PR Merges
Vendex slots into your CI/CD pipeline as a security gate. A full 50-hop transitive dependency scan completes in under 4 minutes — fast enough to run on every PR. CPU-based SCA tools force a choice between speed and depth. Vendex delivers both.
- –GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure DevOps native
- –Scans containers (Docker/OCI) and infrastructure-as-code (Terraform)
- –Pre-commit hooks and merge gates configurable per risk threshold
- –SLSA L3 provenance and Sigstore signature verification included
GPU-Native at Every Layer
CUDA Toolkit
Parallel dependency graph construction from package manifests
cuGraph
GPU-accelerated BFS/DFS transitive resolution across 50-hop trees
Nvidia TensorRT for RTX
Malicious code classifiers at 97%+ recall, CI/CD latency
NeMo Framework
GPU-scale training of malicious package detection models
NeMo Agent Toolkit
Autonomous NIM investigation and block/warn/allow decisions
Supply Chain Feeds Runtime Detection
When Vendex flags a compromised package, that alert flows directly into Quellra Core's unified incident pipeline. If the package was already deployed to production, Core immediately correlates runtime behavior with the supply chain compromise — giving security teams the full attack chain from source to runtime in a single view.
Enterprise-Grade Security at Every Layer
NVIDIA AI Enterprise provides FIPS 140-2 validated containers. Customer data never leaves your environment.
Customer Data Isolation
All telemetry processed in dedicated VPC. Only anonymized 128-dimensional embeddings leave customer environment.
Air-Gap Capable
Jetson Orin runs full inference pipeline with zero cloud dependency. GPIO relay operates independently of IP network.
Auditable Agent Actions
Every containment action logged with timestamps, confidence scores, and reversibility flags. Full forensic trail.
Powered by the full NVIDIA AI stack
StopSupplyChainThreatsBeforeTheyEnterProduction
Vendex scans 10M+ packages in under 4 minutes. Integrate with your CI/CD pipeline and run your first full-depth analysis today.