Supply Chain Monitor

Monitors security news for supply chain attacks targeting packages used in CI/CD pipelines, AI/ML tooling, and developer dependencies. Extracts compromised package names and updates the framework's blocklist.

When to Use

• Before accepting upstream skills (upstream-sync)
• Before any release (refresh the blocklist first)
• User asks about supply chain security or package safety
• Periodically to keep BLOCKED_PACKAGES in security_scan.py current

When NOT to Use

• General security auditing (use security-scanning-security-hardening)
• Dependency version updates (use Dependabot/Renovate)

Quick Start