Supply Chain Review

# Supply Chain Review

When the user asks about dependency security, supply chain hardening, or wants to review
the safety of their installed packages, use this skill.

## What to check

1. **Lockfile integrity** — Are `package-lock.json` / `yarn.lock` / `uv.lock` committed and up to date?
2. **Pinned versions** — Are dependencies pinned to exact versions (not ranges)?
3. **Install scripts** — Run `npm pkg get scripts.postinstall` or check `setup.py` for install-time code execution.
4. **Known vulnerabilities** — Run `npm audit` or `pip audit` if available.
5. **Forensic logs** — Check `~/.dep-guard/logs/` for recent audit logs from Dependency Guard.

## Recent attack patterns to watch for

- **Phantom dependencies**: A package adds a dependency that doesn't exist on the registry, then publishes it with malware (e.g., axios + plain-crypto-js).
- **Postinstall RATs**: Malicious code in postinstall hooks that phones home and drops a remote access trojan (e.g., LiteLLM .pth file attack).
- **Typosquatting**: Packages with names similar to popular ones (e.g., `axois` instead of `axios`).
- **Credential harvesting**: Postinstall scripts that read ~/.ssh, ~/.aws, or environment variables and exfiltrate them.

## Hardening recommendations

- Disable install scripts globally: `npm config set ignore-scripts true` (re-enable per package as needed)
- Use `--ignore-scripts` flag for installs of unfamiliar packages
- Pin all dependency versions and commit lockfiles
- Review diffs when lockfiles change in PRs