Harden your package manager configs against supply chain attacks.
A compilation of resources in the software supply chain security domain, with emphasis on open source
Split and distribute your private keys securely amongst untrusted network
A compilation of Software Supply Chain Security resources including initiatives, standards, regulations, organizations, vendors, tooling, books, articles and a plethora of learning resources from the web.
List your dependencies capabilities and monitor if updates require more capabilities.
Scan GitHub Actions Workflow logs for IOCs
A phishing-led npm supply chain attack compromised millions of weekly downloads, but IoCs, detection scripts, and remediation steps can help developers defend fast.
Packj audits pull requests for malicious/risky open-source deps
Checks your files for existence of Unicode BIDI characters which can be misused for supply chain attacks. See CVE-2021-42574
Forensic CLI for AI-era supply-chain attacks: XZ tarball diffs, prompt injection scans, MCP/CLAUDE.md/Cursor config audits. SARIF for GitHub Code Scanning.
GitHub Action to detect adversarial Unicode in PRs: invisible characters, bidi attacks, homoglyphs, PUA code points, and encoding issues. Zero-config, language-agnostic.
A local-first application and supply-chain security engine spanning dependency security, install-time enforcement, host inventory, secrets, license compliance, SAST/malware analysis, cloud posture, easm, compliance frameworks mapping, kev, epss, and CI/CD gating.
New Android supply chain attack surface
examination of linker behaviors in ELF toolchains
Adaptive multi-agent simulation of cyber attack chains + defender response — modeled on MITRE ATT&CK, cloud IAM, and supply chain threats.
Awesome Supply Chain Attack
Supply Chain Attack Detection and Response Analyst's Cookbook
Threat hunting investigation in Splunk - supply chain attack via malicious npm package. TryHackMe Operation: Health Hazard. 335 pts.
This repository is a security research project demonstrating supply chain attack techniques in the Go ecosystem. It is designed for educational and defensive security purposes only.
PoC backdoor embedded within the C runtime zero
To associate your repository with the supply-chain-attacks topic, visit your repo's landing page and select "manage topics."