Skip to content
#

supply-chain-attack

Star

Here are 31 public repositories matching this topic...

Language: All
Filter by language
All 31 Shell 7 Python 6 PowerShell 4 JavaScript 3 TypeScript 2 C# 1 Go 1 HTML 1 Open Policy Agent 1
Sort: Most stars
Sort options
Most stars Fewest stars Most forks Fewest forks Recently updated Least recently updated
thumper

jestasecurity / thumper

Star 117

Thumper is an open-source tripwire for the Shai-Hulud npm worm. Plant fake-but-realistic credentials where the worm scans - the instant one is read, you know the box might be breached. Free and built in the open by Jesta.

open-source npm security canary incident-response tripwire devsecops malware-detection honeytoken threat-detection credential-theft endpoint-security canarytokens supply-chain-security npm-security shai-hulud supply-chain-attack honeytokens
  • Updated Jun 21, 2026
  • Python

dream-horizon-org / sentinel

Star 4

Sentinel Package Manager blocks compromised packages BEFORE installation, preventing malicious code execution. Features: Pre-install blocking, command interception (npm/yarn/pnpm/bun), 795+ blacklist (Shai-Hulud), real-time checks (OSV/GitHub/Snyk), zero dependencies, auto-updates. Counters supply chain attacks.

npm security package-manager blacklist yarn pnpm security-tools bun vulnerability-scanner malware-detection zero-dependencies dependency-security supply-chain-security npm-security shai-hulud supply-chain-attack pre-install-validation package-validation npm-worm compromised-packages
  • Updated Dec 2, 2025
  • JavaScript

josedacosta / shai-hulud-detector

Sponsor
Star 2

🛡️ Advanced NPM supply chain attack detection tool - Specialized in detecting Shai-Hulud compromise indicators with beautiful CLI interface and automated security reporting

threat-hunting vulnerability-detection security-analysis malware-detection defensive-security npm-audit malicious-packages compromise-detection crypto-stealer npm-security shai-hulud shai-hulud-detector shai-hulud-attack supply-chain-attack self-replicating-worm github-actions-malware bundle-js-detection trufflehog-abuse cli-security-tool package-scanner
  • Updated Sep 19, 2025
  • TypeScript

wuwatracker / remote-script-swap-demo

Star 2

Educational demo showing how a trusted remote PowerShell script can be silently swapped when served from a mutable source URL. The import tutorial at wuwatracker.com does NOT do this and uses hashed URLs instead to prevent this attack.

security exploit script malware poc vulnerability web-security genshin-impact zenless-zone-zero honkai-star-rail arknights-endfield wuthering-waves supply-chain-attack duet-night-abyss
  • Updated Mar 4, 2026
  • PowerShell

fabriziosalmi / tanstack-compromise-checker

Sponsor
Star 2

Shell script to detect TanStack npm supply chain attack indicators (CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx)

docker security-audit incident-response bash-script security-scanner security-tools zero-day devsecops malware-detection github-actions compromise-detection supply-chain-security dependency-scanner ghsa tanstack ioc-detection npm-security shai-hulud supply-chain-attack cve-2026-45321
  • Updated Jun 15, 2026
  • Shell

thebasedcapital / pfw

Star 1

Package Firewall — self-hosted supply chain security for macOS. Intercepts npm/pip/cargo/yarn in ALL shells including AI agents. 4 vuln sources (OSV + GHSA + deps.dev + CISA KEV). Zero telemetry.

macos security package-manager firewall self-hosted cve osv sca devsecops vulnerability-scanner malware-detection lulu dependency-security supply-chain-security ai-agent-security npm-security zero-telemetry supply-chain-attack pip-security cargo-security
  • Updated Apr 1, 2026
  • TypeScript

Improve this page

Add a description, image, and links to the supply-chain-attack topic page so that developers can more easily learn about it.

Curate this topic

Add this topic to your repo

To associate your repository with the supply-chain-attack topic, visit your repo's landing page and select "manage topics."

Learn more