supply-scan 1.0.3 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +31 -9
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -2,12 +2,29 @@
|
|
|
2
2
|
|
|
3
3
|
Universal npm supply chain attack scanner. Detects compromised packages from **12 known attacks** spanning 2018-2026. Zero runtime dependencies.
|
|
4
4
|
|
|
5
|
+
[](https://npmjs.org/package/supply-scan)
|
|
6
|
+
[](https://npmjs.org/package/supply-scan)
|
|
7
|
+
[](https://www.npmjs.com/package/supply-scan)
|
|
8
|
+
[](https://github.com/AsyrafHussin/supply-scan/blob/main/LICENSE)
|
|
9
|
+
[](http://makeapullrequest.com)
|
|
10
|
+
[](https://github.com/AsyrafHussin/supply-scan/actions)
|
|
11
|
+
|
|
5
12
|
```bash
|
|
6
13
|
npx supply-scan
|
|
7
14
|
```
|
|
8
15
|
|
|
9
16
|
> Requires Node.js >= 20
|
|
10
17
|
|
|
18
|
+
## Features
|
|
19
|
+
|
|
20
|
+
- **Interactive CLI** — Arrow-key rule selection and path picker
|
|
21
|
+
- **12 attack rules** — Axios, Chalk/Debug, Shai-Hulud, GlassWorm, and more
|
|
22
|
+
- **5 check categories** — Packages, malware files, network, processes, caches
|
|
23
|
+
- **All package managers** — npm, pnpm, yarn (v1 & v2+), bun
|
|
24
|
+
- **CI mode** — Non-interactive with exit codes for pipelines
|
|
25
|
+
- **Zero runtime deps** — Security scanner that doesn't depend on potentially compromised packages
|
|
26
|
+
- **Extensible** — Add new attacks by dropping a JSON file in `rules/`
|
|
27
|
+
|
|
11
28
|
## What It Detects
|
|
12
29
|
|
|
13
30
|
| Attack | Date | Severity | Type |
|
|
@@ -29,7 +46,7 @@ npx supply-scan
|
|
|
29
46
|
|
|
30
47
|
1. **Compromised Packages** — Scans `node_modules` and lockfiles for known bad versions
|
|
31
48
|
2. **Malware Files** — Checks for RAT payloads, droppers, and artifacts on disk
|
|
32
|
-
3. **Network Connections** — Detects active connections to C2 servers
|
|
49
|
+
3. **Network Connections** — Detects active connections to C2 servers (regex word-boundary matching)
|
|
33
50
|
4. **Suspicious Processes** — Identifies running malware and persistence mechanisms
|
|
34
51
|
5. **Package Manager Caches** — Scans npm, pnpm, yarn, and bun caches for malicious packages
|
|
35
52
|
|
|
@@ -51,7 +68,7 @@ npx supply-scan
|
|
|
51
68
|
npx supply-scan
|
|
52
69
|
```
|
|
53
70
|
|
|
54
|
-
|
|
71
|
+
Uses arrow keys to select which attacks to scan and which directories to scan.
|
|
55
72
|
|
|
56
73
|
### Scan All Attacks
|
|
57
74
|
|
|
@@ -130,11 +147,15 @@ No code changes needed — the scanner automatically picks up new rule files. Se
|
|
|
130
147
|
|
|
131
148
|
```
|
|
132
149
|
supply-scan/
|
|
133
|
-
├── src/
|
|
150
|
+
├── src/
|
|
134
151
|
│ ├── index.ts # CLI entry + interactive prompts
|
|
135
152
|
│ ├── scanner.ts # Scan engine orchestrator
|
|
136
|
-
│ ├── ui.ts # Terminal UI (zero deps, ANSI
|
|
137
|
-
│ ├──
|
|
153
|
+
│ ├── ui.ts # Terminal UI (zero deps, ANSI + truecolor)
|
|
154
|
+
│ ├── args.ts # CLI argument parser
|
|
155
|
+
│ ├── rules.ts # Rule loader + base64 decoder
|
|
156
|
+
│ ├── shell.ts # Safe shell command execution
|
|
157
|
+
│ ├── prompt.ts # Readline prompt helper
|
|
158
|
+
│ ├── utils.ts # Path/fs utilities
|
|
138
159
|
│ ├── types.ts # TypeScript interfaces
|
|
139
160
|
│ └── checks/
|
|
140
161
|
│ ├── packages.ts # Package + lockfile scanner
|
|
@@ -142,14 +163,15 @@ supply-scan/
|
|
|
142
163
|
│ ├── network.ts # C2 connection checker
|
|
143
164
|
│ ├── processes.ts # Process + persistence scanner
|
|
144
165
|
│ └── cache.ts # Package manager cache scanner
|
|
145
|
-
├── rules/ # Attack definitions (JSON)
|
|
146
|
-
├── __tests__/ # Unit tests (Vitest)
|
|
166
|
+
├── rules/ # Attack definitions (JSON, base64-encoded IOCs)
|
|
167
|
+
├── __tests__/ # Unit tests (Vitest, 52 tests)
|
|
168
|
+
├── scripts/ # Rule encoding utility
|
|
147
169
|
├── docs/ # Rule writing guide
|
|
148
|
-
├── .github/workflows/ # CI + publish + dependency review
|
|
170
|
+
├── .github/workflows/ # CI (Node 20/22/24) + npm publish + dependency review
|
|
149
171
|
└── dist/ # Compiled output (tsup, single file)
|
|
150
172
|
```
|
|
151
173
|
|
|
152
|
-
**Zero runtime dependencies.** This is a security scanner — we don't depend on packages that could themselves be compromised.
|
|
174
|
+
**Zero runtime dependencies.** This is a security scanner — we don't depend on packages that could themselves be compromised. All terminal UI uses raw ANSI escape codes with truecolor support and graceful fallback.
|
|
153
175
|
|
|
154
176
|
## Contributing
|
|
155
177
|
|