Performs deep security audits of software supply chains by analyzing SBOMs, verifying dependency integrity, and inspecting CI/CD pipelines for tampering.
Supply Chain Forensics is a specialized security skill designed to identify compromises before software reaches production. It automatically detects project ecosystems, generates and validates SBOMs (CycloneDX/SPDX), and cross-references dependency hashes against official registries. The skill goes beyond simple scanning by analyzing build scripts for malicious patterns, detecting typosquatting attempts, and assessing projects against SLSA (Supply-chain Levels for Software Artifacts) framework benchmarks to ensure high-integrity delivery pipelines.
주요 기능
01Cross-ecosystem dependency integrity verification for npm, pip, Go, and Cargo
02Automated SBOM generation and validation for multi-language projects
03CI/CD pipeline auditing for malicious scripts, unpinned actions, and privilege escalation
04102 GitHub stars
05Typosquatting and dependency confusion attack detection using Levenshtein distance
06SLSA level assessment and build reproducibility verification
사용 사례
01Auditing a project before a major release to ensure no malicious dependencies were introduced
02Generating compliance-ready SBOMs and forensic findings for stakeholder reporting
03Investigating potential CI/CD tampering following a security alert or suspicious workflow change
