ptn1411 SBOM Supply Chain Auditor
Purpose
Use after source recovery or on application repos to identify dependency and supply-chain risks.
Workflow
- Run
python sbom-supply-chain-auditor/scripts/analyze_supply_chain.py <target> --out output/sbom-supply-chain-auditor. - Review
findings.jsonandREPORT.md. - Use findings to prioritize dependency pinning, secret rotation, and package trust review.
Coverage
- Install-time execution — npm
preinstall/install/postinstall/preparescripts. - Version hygiene — floating/unpinned npm & Python versions;
file:local deps. - Remote sources —
git+/http(s)deps (high unless pinned to a commit hash). - Dependency confusion — scoped
@scope/pkgthat may resolve from the public registry. - Typosquat / malware — names one edit from popular packages, and a curated known-malicious list (critical).
- Lockfile integrity —
package-lock.jsonentries missing integrity hashes. - License risk — missing license, or copyleft/restrictive (AGPL/GPL/SSPL/UNLICENSED).
- Secrets — password/token/secret-like values in manifests.
Heuristic, not a CVE feed. Typosquat/known-malicious lists are a curated subset — pair with a vulnerability database for full coverage.
Outputs
findings.jsonREPORT.md
Anti-Patterns
- Do not claim CVE coverage without integrating a vulnerability database.
- Do not auto-update dependencies from this skill.