supply-chain-audit

name	supply-chain-audit
description	Audit the supply-chain threat landscape of project dependencies. Part of the Nomark Method Layer 1 security scanning. Use whenever dependency files change (package.json, requirements.txt, go.mod, Cargo.toml), someone adds a new dependency, or someone asks 'are our dependencies safe', 'dependency audit', 'supply chain risk'.

Supply Chain Risk Auditor

Adapted from Trail of Bits' supply-chain-risk-auditor skill. Evaluates the security posture of project dependencies because your app is only as secure as its weakest dependency.

What You're Auditing

Known Vulnerabilities

• Check dependencies against known CVE databases
• Run npm audit, pip-audit, cargo audit, govulncheck as appropriate
• Flag severity: Critical, High, Medium, Low
• Check if patches are available

Dependency Health Signals

For each significant dependency, assess:

• Maintenance status: Last commit date, release frequency, open issue count
• Maintainer count: Single maintainer = bus factor risk
• Download/usage stats: Very low usage for a critical function = suspicious
• License compatibility: Does the license work with your project?

Supply Chain Attack Vectors

• Typosquatting: Does this package name closely resemble a popular package? (lodash vs l0dash)
• Dependency confusion: Could an internal package name collide with a public one?
• Compromised maintainer: Has the package ownership changed recently?
• Install scripts: Does the package run code during npm install / pip install?
• Excessive permissions: Does a "color formatting" library need network access?

Dependency Hygiene

• Version pinning: Are versions pinned or floating? (Floating = you auto-adopt compromised releases)
• Lock file integrity: Is the lock file committed and up to date?
• Transitive depth: How deep is the dependency tree? Each level adds risk.
• Unused dependencies: Dependencies that aren't imported but are installed = unnecessary attack surface

Audit Protocol

1. Identify dependency files in the change set
2. Run automated vulnerability scanning (npm audit, pip-audit, etc.)
3. For new/changed dependencies:
   a. Check package registry for health signals
   b. Review install scripts
   c. Check for typosquatting indicators
   d. Assess maintenance status
4. Classify findings by severity
5. Recommend: update, replace, or accept with justification

Output Format

SUPPLY CHAIN AUDIT — [timestamp]
Dependencies analyzed: [count]
New/changed: [count]

🔴 CRITICAL — lodash@4.17.20 has known prototype pollution (CVE-2021-23337)
   Fix: Upgrade to lodash@4.17.21+

🟡 WARNING — new-dep@1.0.0 has 1 maintainer, 12 weekly downloads, first published 30 days ago
   Risk: Low adoption, potential typosquat or abandoned package
   Action: Manual review recommended before adopting

🟡 WARNING — package-lock.json not committed
   Risk: Builds may use different dependency versions than tested
   Action: Commit lock file

🟢 [count] dependencies passed all checks