Version updated for https://github.com/homeofe/supply-chain-guard to version v5.26.3. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary The GitHub Action supply-chain-guard is an open-source tool designed to scan project dependencies across various ecosystems (npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, GitHub Actions and repositories) for malware, fake AI tool repos, account takeovers, and numerous security threats. It generates CycloneDX SBOMs and SLSA provenance to detect and correlate findings into attack-chain incidents, providing comprehensive supply chain security audits.

Version updated for https://github.com/homeofe/supply-chain-guard to version v5.25.8. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary The supply-chain-guard GitHub Action is an open-source tool that performs a comprehensive supply-chain security scan for various ecosystems including npm, PyPI, Cargo, Go, RubyGems, Composer, NuGet, Docker, Terraform, VS Code extensions, and GitHub repositories. It detects malware campaigns such as GlassWorm, Vidar/GhostSocks, and Shai-Hulud, as well as fake AI tool repos and account takeovers. The action generates CycloneDX SBOMs with real dependency inventories and SLSA provenance for each scan result.