supply-chain-guard 5.4.0 → 5.4.1

package/README.md

@@ -370,9 +370,16 @@ supply-chain-guard is both a scanner OF the agentic ecosystem and a tool FOR it.
 **Built-in MCP server** - let your AI agent vet packages BEFORE installing them:
 
 ```bash
-claude mcp add supply-chain-guard -- npx -y supply-chain-guard mcp
+npm install -g supply-chain-guard
+claude mcp add supply-chain-guard supply-chain-guard mcp
 ```
 
+This form works in every shell (bash, zsh, PowerShell, cmd) and avoids npx
+cold-start timeouts on first connect. On bash/zsh you can use the one-liner
+`claude mcp add supply-chain-guard -- npx -y supply-chain-guard mcp` instead;
+note that PowerShell swallows the bare `--` itself, so on Windows prefer the
+global-install form above.
+
 Exposes three tools over stdio: `ioc_lookup` (offline IOC + known-bad-version check
 for npm/PyPI/RubyGems/Composer/NuGet), `scan_directory`, and `scan_npm_package`.
 Client config snippets for Claude Code, Claude Desktop, and Cursor: [docs/mcp.md](docs/mcp.md).

package/dist/cli.js

@@ -20,7 +20,7 @@ const program = new commander_1.Command();
 program
     .name("supply-chain-guard")
     .description("Open-source supply-chain security scanner. Detects GlassWorm and similar malware campaigns in npm packages, PyPI packages, code repos, VS Code extensions, and project dependencies.")
-    .version("5.4.0");
+    .version("5.4.1");
 // ── scan command ────────────────────────────────────────────────────
 program
     .command("scan")

package/dist/reporter.js

@@ -55,7 +55,7 @@ function formatJson(report) {
 function formatText(report) {
     const lines = [];
     // ── layout constants ───────────────────────────────────────────────────────
-    const VERSION = "5.4.0";
+    const VERSION = "5.4.1";
     const W = 76; // visible chars between "│ " and " │" (total line = 80)
     // ── ANSI helpers ───────────────────────────────────────────────────────────
     const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -490,7 +490,7 @@ function formatSarif(report) {
                 tool: {
                     driver: {
                         name: "supply-chain-guard",
-                        version: "5.4.0",
+                        version: "5.4.1",
                         informationUri: "https://github.com/homeofe/supply-chain-guard",
                         rules,
                     },
@@ -552,7 +552,7 @@ function formatSbom(report) {
             timestamp: report.timestamp,
             tools: {
                 components: [
-                    { type: "application", name: "supply-chain-guard", version: "5.4.0" },
+                    { type: "application", name: "supply-chain-guard", version: "5.4.1" },
                 ],
             },
             component: {
@@ -704,7 +704,7 @@ footer{text-align:center;padding:24px;color:#94a3b8;font-size:13px}
   ` : ""}
 
   <footer>
-    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.4.0
+    Generated by <a href="https://github.com/homeofe/supply-chain-guard">supply-chain-guard</a> v5.4.1
   </footer>
 </div>
 <script>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supply-chain-guard",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "description": "Open-source supply-chain security scanner for npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, VS Code extensions, GitHub Actions, IaC and Solana C2. Detects GlassWorm, Shai-Hulud, PPE attacks, dependency confusion and 180+ threat indicators across all major lockfile formats (npm, pnpm, yarn, bun). Generates CycloneDX 1.6 SBOMs, verifies SLSA provenance, and correlates findings into attack-chain incidents.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",