What is supply-chain-attack?

This JavaScript tool checks whether your computer has been affected by known "supply-chain attacks", a type of security breach where malicious code is secretly slipped into popular software packages that developers download and use. Think of it like a contaminated ingredient in a recipe: the finished dish looks fine, but the harm is already inside. To use it, you run a single command in your terminal, no installation required, and it scans your local package manager files (the places where downloaded software is stored). It checks npm, pnpm, Yarn, Bun, and Python environments for known bad packages using a built-in, offline list of advisories. It also flags any packages whose setup scripts try to make internet connections, which can be a sign of malicious behavior. The tool produces a clear report showing whether any suspicious packages were found, which specific packages triggered the alert, and how many package locations were scanned. In an interactive terminal, it offers menu options to learn more and take remediation steps. You can also run it with flags to get JSON output, list all tracked advisories, or turn off colors. Importantly, the scan is entirely offline, no data about your machine or your packages is sent anywhere. A clean result does not guarantee total safety, since the advisory list is a snapshot in time, but a positive finding is a strong signal to remove affected packages, clear caches, and rotate any credentials that may have been exposed. Built with JavaScript and requires Node.js 18 or newer.