{
  "name": "supply-chain-guard",
  "version": "6.3.1",
  "mcpName": "io.github.homeofe/supply-chain-guard",
  "description": "Open-source supply-chain security scanner, local and offline. Matches known-malicious packages, extensions, plugins, providers, container images and CI actions in 15 ecosystems, including transitive lockfile dependencies at any depth, and detects GlassWorm, Shai-Hulud, PPE attacks, dependency confusion and 350+ threat indicators. Generates CycloneDX 1.6 SBOMs, grades SLSA provenance (in-toto/DSSE structural validation), and correlates findings into attack-chain incidents.",
  "main": "dist/index.js",
  "types": "dist/index.d.ts",
  "bin": {
    "supply-chain-guard": "dist/cli.js"
  },
  "scripts": {
    "build": "tsc",
    "test": "node scripts/run-vitest-clean.mjs",
    "test:coverage": "node scripts/run-vitest-clean.mjs --coverage",
    "test:watch": "vitest",
    "lint": "tsc --noEmit",
    "check:aahp": "node scripts/check-aahp-pin.mjs && node scripts/check-em-dash-scope.mjs && npx --no-install aahp check .",
    "check:handoff": "node scripts/scg-handoff-docs.mjs --check",
    "check:self-scan": "node scripts/generate-self-scan-manifest.mjs --check",
    "self-scan:generate": "node scripts/generate-self-scan-manifest.mjs",
    "check:release-ancestry": "node scripts/check-release-ancestry.mjs",
    "handoff:refresh": "node scripts/scg-handoff-docs.mjs",
    "feed:generate": "node scripts/generate-feed.mjs",
    "audit:blocklist": "node scripts/audit-blocklist.mjs",
    "feed:import": "node scripts/import-threat-feed.mjs",
    "feed:migrate": "node scripts/feed-migrate.mjs",
    "catalog:generate": "node scripts/generate-catalog.mjs",
    "check:catalog": "node scripts/generate-catalog.mjs --check",
    "release:prepare": "node scripts/release-prepare.mjs",
    "check:feed": "node scripts/generate-feed.mjs --check",
    "check:feed-partition": "node scripts/check-feed-partition.mjs",
    "check:feed-budget": "node scripts/check-feed-budget.mjs",
    "prebuild": "npm run check:aahp && npm run check:feed && npm run check:coverage && npm run check:feed-partition && npm run check:feed-budget && npm run check:catalog && npm run check:handoff && npm run check:log-archive && npm run check:self-scan",
    "prepublishOnly": "npm run build",
    "prepare": "tsc",
    "coverage:generate": "node scripts/generate-coverage-table.mjs",
    "check:coverage": "node scripts/generate-coverage-table.mjs --check",
    "check:log-archive": "npx --no-install aahp archive . --verify"
  },
  "keywords": [
    "security",
    "supply-chain",
    "malware-detection",
    "npm",
    "pypi",
    "cargo",
    "golang",
    "docker",
    "terraform",
    "glassworm",
    "shai-hulud",
    "scanner",
    "cli",
    "github-action",
    "sarif",
    "sbom",
    "slsa",
    "cyclonedx",
    "devsecops",
    "threat-intelligence",
    "maven",
    "gradle",
    "nuget",
    "rubygems",
    "composer",
    "vscode-extensions",
    "browser-extensions",
    "homebrew",
    "helm",
    "lockfile"
  ],
  "author": "Elvatis <emre.kohler@elvatis.com>",
  "license": "Apache-2.0",
  "repository": {
    "type": "git",
    "url": "https://github.com/homeofe/supply-chain-guard.git"
  },
  "bugs": {
    "url": "https://github.com/homeofe/supply-chain-guard/issues"
  },
  "homepage": "https://github.com/homeofe/supply-chain-guard#readme",
  "engines": {
    "node": ">=22.0.0"
  },
  "files": [
    "dist/**/*",
    "action.yml",
    "README.md",
    "LICENSE",
    "socket.yml",
    "policy-schema.json",
    "self-scan-manifest.json"
  ],
  "dependencies": {
    "commander": "^14.0.3"
  },
  "devDependencies": {
    "@babel/parser": "^8.0.6",
    "@elvatis_com/aahp": "3.12.0",
    "@types/node": "^26.6.2",
    "@vitest/coverage-v8": "^5.0.1",
    "ajv": "^8.20.0",
    "ajv-formats": "^3.0.1",
    "fast-check": "4.10.2",
    "packageurl-js": "^2.0.1",
    "typescript": "^7.0.2",
    "vitest": "^5.0.1"
  }
}