Supply Chain Attack Response

Software supply chain attacks target the dependencies, build systems, and distribution channels that developers trust implicitly. When a package on PyPI, npm, or crates.io is compromised, every downstream consumer inherits the malicious payload. This skill provides detection techniques, emergency response playbooks, and hardening strategies to protect your software supply chain end to end.

1. When to Use This Skill

Invoke this skill when any of the following apply:

• A dependency you consume has been flagged as compromised (e.g., advisories on OSV.dev, GitHub Advisory Database, or vendor disclosure).
• You observe suspicious behavior from a dependency: unexpected network calls, file system writes outside its scope, or new post-install scripts.
• You are conducting a periodic supply chain security audit.
• A CI/CD pipeline is behaving unexpectedly after a dependency update.
• You are onboarding a new third-party dependency and want to verify its provenance.
• You need to respond to an incident such as a typosquatted package or registry account takeover.
• You are implementing SLSA compliance or need to generate build provenance.