supply-chain-advisory

name	supply-chain-advisory
description	Audits dependency supply chains for bad versions, lockfile drift, and artifact integrity. Use when adding deps, handling incidents, or releasing a plugin.
alwaysApply	false
category	infrastructure
tags	["security","supply-chain","dependencies","vulnerability","pypi"]
dependencies	["error-patterns"]
provides	{"infrastructure":["supply-chain-scanning","dependency-auditing","incident-response"],"patterns":["known-bad-detection","lockfile-audit","artifact-scanning"]}
usage_patterns	["dependency-security-check","incident-response","supply-chain-audit"]
complexity	intermediate
model_hint	standard
estimated_tokens	500
progressive_loading	true
modules	["modules/scanning-patterns.md","modules/incident-response.md"]
role	hook-target

Overview

Supply chain attacks bypass traditional code review by compromising upstream dependencies. This skill provides patterns for detecting, preventing, and responding to compromised packages in Python ecosystems.

When To Use

• After a supply chain advisory is published
• When auditing dependencies for a new or existing project
• During incident response for a suspected compromise
• When adding the SessionStart hook to a project

When NOT To Use

• General CVE triage unrelated to dependency supply chain
• Application-level vulnerability scanning (use a SAST tool)
• License compliance audits (different concern)

Known-Bad Versions Blocklist

The blocklist is at ${CLAUDE_SKILL_DIR}/known-bad-versions.json. It is consumed by:

1. SessionStart hook: warns per-session when compromised versions detected
2. make supply-chain-scan: CI/local scanning target
3. This skill: manual audit guidance

Blocklist Format

{
  "package_name": [{
    "versions": ["x.y.z"],
    "date": "YYYY-MM-DD",
    "description": "What the attack did",
    "indicators": ["files or patterns to search for"],
    "source": "advisory URL",
    "severity":