elastic/supply-chain-monitor

A simple project to detect the Shai-Hulud npm supply chain attack

GitHub Action that detects the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain attacks. Scans dependencies, lockfiles and CI workflows against a daily-updated database of 1,200+ compromised packages, flags malicious install scripts, TruffleHog secret theft and SHA1HULUD runners. SARIF output for GitHub Code Scanning.

Supply Chain Firewall (SCFW) is a tool for preventing the installation of malicious npm and PyPI packages 🔥

🐍 🔎 GuardDog is a CLI tool to Identify malicious PyPI and npm packages

Malicious package & supply-chain intelligence

Packj stops ⚡ Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain

Protect against malicious code installed via npm, yarn, pnpm, npx, pnpx, pip, uv and poetry with Aikido Safe Chain. Free to use, no tokens required.

A repository of reports of malicious packages identified in Open Source package repositories, consumable via the Open Source Vulnerability (OSV) format.

Protect against malicious open source packages 🤖