Detect and remediate software supply chain attacks in npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines by scanning for known compromised packages, malicious versions, filesystem IOCs, C2 indicators, and CI/CD misconfigurations.
Automated detection and remediation of software supply chain attacks across npm, PyPI, crates.io, GitHub Actions, and CI/CD pipelines. Built from real-world attack intelligence gathered through March 31, 2026.
Use this skill when:
Identify what the user's project uses:
package.json, package-lock.json, yarn.lock, pnpm-lock.yamlrequirements.txt, Pipfile, pyproject.toml, poetry.lockCargo.toml, Cargo.lock.github/workflows/, Dockerfile, docker-compose.ymlThe skill includes three specialized scanners plus a unified runner. All scripts are in the scripts/ directory.
Full audit (recommended):
bash /path/to/supply-chain-guard/scripts/scan-all.sh /path/to/project
Individual scanners:
# npm/Node.js projects
bash /path/to/supply-chain-guard/scripts/scan-npm.sh /path/to/project
# Python/PyPI projects
bash /path/to/supply-chain-guard/scripts/scan-python.sh /path/to/project
# CI/CD pipeline audit
bash /path/to/supply-chain-guard/scripts/scan-ci.sh /path/to/project
Each scanner checks for:
Scanners exit with the number of issues found (0 = clean). Issues are categorized:
Based on findings, guide the user through remediation:
npm cache clean --force / pip cache purgenode_modules / .venv and reinstall from lockfile--ignore-scripts to npm install/ci commands--require-hashes to pip install commandspull_request_target triggersAfter remediation, recommend these preventive measures:
npm ci (not npm install), pip install --require-hashes--ignore-scripts by default, enable only for trusted packagesreferences/ioc-database.md — Full IOC database with all compromised packages, malicious versions, C2 infrastructure, filesystem indicators, and attack timelines. Read this file for detailed intelligence on specific attacks.The most significant active threat. TeamPCP is executing a cascading credential-chain campaign:
plain-crypto-js dependencyWhen new supply chain attacks are reported:
references/ioc-database.md with new packages, versions, domains, IPsioc-db-date in the SKILL.md frontmatter