This is an interesting statement in the 'Software Supply Chain Vendor Landscape' analysis document from @InvestiAnalyst for @tldrsec. From a brief search it looks like @snyksec, @QwietAI and @mend_io also claim to be able to do this... Seems like aa 'caveat emptor' situation...