As modern businesses increasingly depend on third-party digital code to power their websites, cloud systems, and mobile applications, the risk of hidden vulnerabilities embedded deep within software supply chains has emerged as one of global technology’s most urgent challenges.

Addressing this critical industry blind spot, UK-based cybersecurity specialist and software engineer Adebayo Aderibigbe has developed LeetGuard, an open-source security scanner designed to inspect third-party software dependencies and automate supply-chain compliance against international security benchmarks.

Aderibigbe, who completed his Master of Science in Cyber Security with Distinction in the United Kingdom and is an accredited ISO/IEC 27001 Lead Auditor, engineered the tool to resolve a major limitation in traditional application security workflows.

While conventional dependency checkers, such as standard package managers and vulnerability scanners, predominantly search for historically reported bugs, they are often blind to unmaintained code libraries and structural dependency decay. If an open-source package has been abandoned by its creators or contains dormant risks that have not yet received an official vulnerability catalogue number, conventional scanners typically report zero warnings.

LeetGuard tackles this issue by combining static package inspection with maintenance health evaluation. In comparative testing across enterprise-grade repositories, the scanner demonstrated its ability to detect critical, unmaintained cryptographic libraries. In one notable benchmark, it identified dormant components in popular enterprise platforms that had gone untouched by maintainers for over four years, representing serious risks that established scanning tools had overlooked entirely.

Crucially, Aderibigbe built LeetGuard to bridge the long-standing gap between technical software developers and corporate risk auditors. The scanner automatically maps identified code risks directly to formal ISO/IEC 27001:2022 control frameworks, including Control A.5.22 on supplier relationship security, generating audit-ready compliance documentation that corporate risk officers can verify directly.

“Modern software development is assembled from hundreds of pre-built open-source libraries,” says Aderibigbe. “If an engineering team imports a single unmaintained package into a financial, medical, or government system, that dependency becomes a latent backdoor. The objective with LeetGuard was to build a tool that not only uncovers these silent risks but translates raw code findings into formal compliance evidence that risk managers can act on immediately.”

The practical value of the tool has already attracted industry interest, receiving positive commendations from visiting Lead Auditors and security practitioners during an academic cyber innovation showcase in the UK.

Aderibigbe has made LeetGuard publicly available as an open-source package on npm, enabling development teams and technology scale-ups globally to conduct automated software dependency audits without incurring prohibitive consulting fees.

As governments and enterprises worldwide intensify their focus on software supply chain security, projects like LeetGuard highlight the vital role of innovative engineering in defending modern digital infrastructure against emerging cyber threats.