supply-chain-guard

supply-chain-guard is an open-source supply-chain security scanner that runs locally and offline. It matches known-malicious packages, extensions, plugins, providers, container images and CI actions across 15 ecosystems, reading manifests and lockfiles at any depth of a repository, including transitive dependencies pinned by a lockfile. It also analyses installed artifacts for malware behaviour, covering campaigns such as GlassWorm, Vidar, Shai-Hulud, fake AI tool repositories and account takeovers, with 350+ threat indicators in total. Beyond matching, it generates CycloneDX 1.6 SBOMs with real dependency inventories, parses and structurally validates in-toto/DSSE attestations to grade SLSA provenance, and correlates individual findings into attack-chain incidents. The project notes support for EU Cyber Resilience Act SBOM and component-documentation work, and NIS2 supply chain risk-management measures. Detection areas include known-malicious package and component identities, malware campaign markers and C2 infrastructure, code-level threats such as obfuscated execution, invisible Unicode, RTL overrides and entropy analysis, install-hook analysis, typosquatting, dependency confusion, starjacking, known-bad version blocklists, GitHub Actions and Dockerfile hardening issues, Terraform/IaC concerns, repository trust signals, prompt-injection tokens aimed at AI coding agents, credential patterns, internal topology disclosure, and dead-drop resolver/C2 detection. A correlation engine links findings into named incidents with confidence scoring, and a trust breakdown scores publisher, code quality, dependency trust and release process. It is distributed via npm (Node.js 22+), npx, a pre-commit hook, a multi-arch Docker image on GHCR, a GitHub Action, and an MCP server for AI coding agents. Output formats include text, JSON, HTML, Markdown, SARIF 2.1.0, CycloneDX SBOM, Shields badge JSON and GitLab Dependency Scanning reports. Exit codes are configurable via --fail-on, and incomplete coverage is surfaced as partialScan rather than silently passing. The scan itself makes no network request; an optional feed refresh and registry queries require network access.