notambourine/wormhook supply-chain scan
Scan the checked-out tree for npm/node + PyPI supply-chain malware (Shai-Hulud 1.0-3.0/Mini, SANDWORM_MODE, Axios/DPRK RAT, Hades/PyPI .pth, remote-eval loaders). Local, zero-network. Fails the job on a confirmed IOC.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Directory to scan. Defaults to the workspace root (the checked-out repo). | no | . |
| mode | "deep" forces the Tier-2 node_modules content walk (run AFTER `npm ci` to scan installed dependencies — the strongest gate). "fast" runs Tier 0+1 only (+Tier 2 on a cache miss) and is enough for a source-only tree. | no | deep |
| fail-on | "critical" (default) fails only on a confirmed IOC (🚨). "degraded" also fails on a degraded scan (🟡 — missing signatures, timeout, unparseable verdict) for a fail-closed posture. | no | critical |
Outputs
no outputs