Skip to content
THREATWIRE

Syft

SBOM generator for images and file systems

CLI tool and Go library from Anchore that generates a software bill of materials from container images and file systems in SPDX and CycloneDX formats.

Open sourceApache-2.0
Alternative toSonatype LifecycleSnyk
View repository Docs
Homepage of Syft
Official repository page, captured by ThreatWire.

What Syft does

Syft inspects container images, directories and archives and lists the packages it finds across operating system package managers and many language ecosystems. The result is a software bill of materials that can be stored, signed and scanned later.

It outputs SPDX, CycloneDX and its own JSON format and pairs naturally with Grype for vulnerability matching.

Key features

  • SBOMs from images, directories and archives
  • SPDX and CycloneDX output
  • Many package ecosystems detected
  • Attestation support for signed SBOMs
  • Usable as a Go library

Licence

Apache-2.0 · Apache License 2.0 · Open source

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.

Security of Syft itself

3 published advisories for Syft in GitHub repository advisories and OSV.dev. Keep the tool updated: security tools often run with broad access.

  • GHSA-mw2c-m758-9v5qmedium2026-09-17

    Memory exhaustion and large allocations when parsing binary inputs

  • GHSA-rjcw-vg7j-m9rcCVE-2026-33481medium2026-03-20

    Syft improper temporary file cleanup

  • GHSA-jp7v-3587-2956CVE-2023-24827medium2023-02-06

    Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Dependencies and SBOM (SCA)Container and Kubernetes security#sbom#spdx#cyclonedx#go#containers#docker#golang#static-analysis#tool

Related tools

  • Grype

    Vulnerability scanner for images, file systems and SBOMs

    Anchore's vulnerability scanner for container images, file systems and SBOMs, matching packages against a regularly updated vulnerability database.

    Stars
    13k
    Forks
    920
    Last commit
    today
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSnykSonatype Lifecycle

  • OSV-Scanner

    Dependency scanner backed by the OSV database

    Google's vulnerability scanner that reads lockfiles, SBOMs and container images and checks the packages against the open OSV.dev database.

    Stars
    11k
    Forks
    816
    Last commit
    7 days ago
    Apache-2.0Open sourceDependencies and SBOM (SCA)
    Alternative toSnykSonatype Lifecycle

  • Trivy

    All-in-one scanner for images, code, IaC and clusters

    Scanner from Aqua Security that finds vulnerabilities, misconfigurations, secrets and licences in container images, file systems, repositories and Kubernetes.

    Stars
    39k
    Forks
    776
    Last commit
    today
    Apache-2.0Open sourceContainer and Kubernetes security
    Alternative toSnykPrisma Cloud+1

  • Checkov

    Static analysis for infrastructure as code

    Policy-as-code scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and more, with graph-based checks across resources.

    Stars
    9.1k
    Forks
    1.4k
    Last commit
    6 days ago
    Apache-2.0Open sourceCloud and IaC security
    Alternative toPrisma CloudWiz+1

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/tools/syft