Version updated for https://github.com/homeofe/supply-chain-guard to version v5.17.8. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary Supply-chain Guard is an open-source tool designed to scan and analyze dependency chains across various package managers and ecosystems, including npm, Pypi, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, GitHub Actions, and repositories. It detects malware campaigns (e.g., GlassWorm, Vidar), fake AI tool repos, account takeovers, and numerous threat indicators across multiple lockfile formats. The action generates CycloneDX SBOMs, validates SLSA provenance, and correlates findings into attack-chain incidents for enhanced security awareness and remediation.

Version updated for https://github.com/homeofe/supply-chain-guard to version v5.17.5. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary Supply-chain-guard is an open-source supply-chain security scanner that detects malware campaigns, fake AI tool repos, account takeovers, and over 350 threat indicators across various ecosystems including npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, GitHub Actions, and GitHub repositories. It generates CycloneDX 1.6 SBOMs with real dependency inventories, parses and validates in-toto/DSSE attestations, and correlates findings into attack-chain incidents.

Version updated for https://github.com/homeofe/supply-chain-guard to version v5.17.4. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary Summary Supply-chain-guard is an open-source supply-chain security scanner that detects malware campaigns and fake AI tool repos across various ecosystems, including npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, GitHub Actions, and repositories. It uses a combination of threat indicators and automated analysis to provide a comprehensive view of the security posture in your software supply chain.

Version updated for https://github.com/homeofe/supply-chain-guard to version v5.12.3. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary This GitHub Action automatically scans various package managers and ecosystems to detect potential security threats such as malware, code-level vulnerabilities, and supply chain attacks. It generates CycloneDX SBOMs to provide a comprehensive view of dependencies and verifies SLSA provenance, helping organizations identify and remediate risks in their software supply chains.

Version updated for https://github.com/homeofe/supply-chain-guard to version v5.12.2. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary supply-chain-guard is an open-source supply-chain security scanner that detects malware campaigns, fake AI tool repos, and other threats across various ecosystems like npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, GitHub Actions, and repositories. It generates CycloneDX SBOMs with real dependency inventories, verifies SLSA provenance, and correlates findings into attack-chain incidents.

Version updated for https://github.com/homeofe/supply-chain-guard to version v5.12.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed v5.12.0 (2026-07-11) Issue #54 hardening: oversized-file transparency + threat-intel indicator contract Implements both hardening gaps tracked in issue #54 (follow-up to the merged PR #55 extraction/IOC hardening), plus the dependency maintenance merged this cycle (docker/login-action 4.4.0, vitest + @vitest/coverage-v8 4.1.10). This minor also carries PR #55’s archive-extraction and self-scan-suppression fix to npm (it landed after v5.11.1 was published).

Version updated for https://github.com/homeofe/supply-chain-guard to version v5.10.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed v5.10.0 (2026-07-08) GitLost-class agentic-workflow posture detection Closes the gap surfaced by Noma Security’s “GitLost” disclosure (July 2026): an AI agent driven by a GitHub workflow can be prompt-injected through an untrusted issue/PR into leaking private-repo data via a public comment. The runtime attack is GitHub’s to fix; what is static and checked-in is the vulnerable POSTURE, and that is now scannable before an attacker files the issue.

Version updated for https://github.com/homeofe/supply-chain-guard to version v5.6.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed v5.6.0 (2026-07-03) Install-time guard + GitLab-native output + registry hardening (both remaining roadmap bets) Ships the last two strategic bets from the 2026-07 roadmap. A second 4-lens adversarial verification gate reviewed the diff and BLOCKED the first candidate with 5 confirmed findings, all fixed here (a real Windows RCE among them). 40 new tests (1120 total).

Version updated for https://github.com/homeofe/supply-chain-guard to version v5.5.0. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed v5.5.0 (2026-07-02) Community batch: all 8 seeded issues shipped, hardened by an adversarial release gate Implements every open issue (#40-#47) in one release. Before tagging, a 4-lens adversarial verification gate reviewed the full diff and BLOCKED the first candidate with 6 confirmed findings - all fixed here (details below). 35 new tests (1057 total).