Package Security Scan
Scan a package before installation:
- Identify package type (pip or npm)
- Run appropriate Sigil scan:
sigil pip <package>for Python packagessigil npm <package>for Node packages
- Review quarantine findings
- Recommend approve/reject based on risk score
Critical patterns to flag:
- Install hooks (setup.py cmdclass, npm postinstall)
- Eval/exec/pickle usage
- Network exfiltration (webhooks, DNS tunneling)
- Credential access (ENV vars, SSH keys)
- Code obfuscation (base64, charCode)
Present findings and guide the user through quarantine approval.