back to projects

supplyscan

scans JavaScript and Python lockfiles for supply-chain compromises and known vulnerabilities. a single Go binary that runs as both a CLI and an MCP server.

view source
0:00

stack

GoGoMCPMCP

about

i built supplyscan to keep up with recent supply-chain attacks, while living outside the supply-chain attack surface. it reads JavaScript and Python lockfiles and flags compromises and known vulnerabilities by aggregating indicators of compromise from DataDog, the GitHub Advisory Database, and OSV.dev, matched per ecosystem to make sure same-named packages don’t collide, and checking for known CVEs through the npm audit API (npm) and OSV.dev (PyPI). CLI and MCP modes live in one binary, switchable with a flag, so the same scanner runs in a terminal or behind an AI agent. written in Go and shipped as a static binary, so the scanner itself can’t be compromised by the package ecosystems it scans. it also refuses to quietly pass what it couldn’t audit, flagging unpinned or lockfile-less dependencies as coverage gaps rather than a false all-clear.

features

  • supply-chain detection across npm and PyPI by aggregating IOCs from DataDog (Shai-Hulud v2 and TeamPCP), the GitHub Advisory Database, and OSV.dev, matched per-ecosystem so same-named packages don't collide
  • vulnerability scanning through the npm audit API for npm and OSV.dev for PyPI
  • multi-format lockfile support across npm, Yarn (classic & berry), pnpm, Bun, Deno, and Python (pip, Poetry, Pipenv, uv, PDM)
  • heuristic advisories for packages that run install scripts and for invisible or non-ASCII characters in package names or URLs
  • CLI and MCP modes in a single binary, switchable with a flag
  • JSON output for scripting and CI use
  • per-source caching with a configurable TTL so each IOC source refreshes on its own schedule
  • shipped as a static Go binary, immune to the package ecosystems it scans