ralianeng/Kojuto Supply Chain Scanner
Detect suspicious syscall activity during package installation
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 13, 2026
- License
- MIT
Pinned Snippet
uses: ralianeng/kojuto@b4ddd5dd4e0980695e938800f2a88f3b090bba63 # v0.5.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| package | Package name to scan (mutually exclusive with file and local) | no | "" |
| version | Package version (default: latest) | no | "" |
| ecosystem | Ecosystem: pypi or npm (default: pypi) | no | pypi |
| file | Dependency file to scan (requirements.txt or package.json) | no | "" |
| pin | Output pinned dependency file after all-clean scan (requires file) | no | "" |
| local | Scan a local package file (.whl, .tgz) or directory | no | "" |
| config | Path to kojuto.yml config file (default: kojuto.yml in current directory) | no | "" |
| runtime | Container runtime: auto (use gVisor if available), runsc (force gVisor), runc (force Docker default) | no | auto |
| probe-method | Probe method: auto, ebpf, strace, strace-container | no | auto |
| timeout | Scan timeout per package (e.g. 5m, 10m) | no | 5m |
| strict | Ignore sensitive_paths.exclude from config (recommended for CI) | no | true |
| quiet | Suppress phase progress output; emit only the final verdict block | no | false |
| no-color | Disable colored output (NO_COLOR env is also respected) | no | false |
Outputs
| name | description |
|---|---|
| verdict | Scan verdict: clean, suspicious, or inconclusive |
| report | Path to JSON report |