bb1nfosec/Bheeshma — Runtime Supply Chain Security
Catch npm supply-chain attacks at runtime. Detects credential theft, backdoors, and exfiltration static analysis misses.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| command | Command to monitor (e.g. "npm test", "npm ci", "node app.js") | yes | — |
| fail-level | Minimum risk level to fail the build. Options: critical, high, medium, low | no | high |
| config | Path to .bheeshmarc.json config file | no | "" |
| sarif-output | Output path for SARIF results file | no | bheeshma-results.sarif |
| skip-low | Skip LOW-risk signals in SARIF to reduce noise | no | true |
| upload-sarif | Upload SARIF to GitHub Code Scanning for inline PR annotations | no | true |
| enforce | Fail the build on any policy violation (same as --enforce flag) | no | false |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the generated SARIF file |
| exit-code | Exit code from bheeshma (0 = clean, 1 = policy violation detected) |
| findings | JSON summary of security findings |