Supply Chain Review

Core Workflow

1. Identify the source, publisher, version, commit, license, install path, and update mechanism.
2. Review dependencies, package managers, install commands, remote downloads, generated code, and executable artifacts.
3. Check whether versions and sources are pinned, inspectable, and reproducible.
4. Look for typosquatting, untrusted domains, opaque binaries, install hooks, telemetry surprises, or broad permissions.
5. Recommend pinning, vendoring, removal, manual review, or blocked install.
6. Record approval conditions and re-review triggers.

Safety Rules