Supply Chain Security Scanner
<p align="center" </p
---
🎯 Overview
Software supply chain security scanner detecting dependency confusion, typosquatting, malicious packages, CI/CD pipeline injection, and SBOM gaps.
| Check | Severity | Description | |-------|----------|-------------| | Dependency Confusion | 🔴 CRITICAL | Internal package names on public registries | | Typosquatting/Combosquatting | 🔴 CRITICAL | npm, PyPI, Maven, Go, cargo | | Malicious Package Detection | 🔴 CRITICAL | Post-install scripts, obfuscated code | | CI/CD Pipeline Injection | 🔴 CRITICAL | GitHub Actions, GitLab CI, Jenkins | | Build Artifact Tampering | 🟠 HIGH | SLSA level verification | | Container Base Image Vulns | 🟠 HIGH | Outdated/vulnerable base images | | SBOM Generation/Gaps | 🟡 MEDIUM | CycloneDX, SPDX compliance | | VEX Adoption | 🟡 MEDIUM | Vulnerability Exploitability eXchange |
---
🚀 Quick Start
git clone https://github.com/ridhinva/supply-chain-scanner.git
cd supply-chain-scanner
pip install requests
python3 supply_chain_scanner.py --target package.json --mode all---
⚖️ Disclaimer
For authorized security testing only.