Skill Data Limited info

supply-chain-risk-auditor

Audit a project's npm, PyPI, and Go dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned upstreams, npm publisher concentration, and install scripts

  • 7.5k GitHub stars
supply-chain-risk-auditor — illustration

Overview

Audit a project's npm, PyPI, and Go dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned upstreams, npm publisher concentration, and install scripts

Detailed guide coming soon. We haven't written a full guide for this skill yet.

View on GitHub (opens in a new tab)