Supply Chain Guardian

Enterprise-grade supply chain security scanner for CI/CD pipelines. Detects compromised dependencies, stolen credentials, network exfiltration, container escape, and 110+ real-world attack patterns across GitHub Actions, GitLab CI, Jenkins, and Azure DevOps.

110+ Attack Patterns 17 Scanner Modules 20 Attack Scenarios GitHub Marketplace
110+
Attack Patterns
17
Scanner Modules
37
Vulnerable Scenarios
8
Pipeline Stages

Scan Reports

Deep Multi-Scanner Analysis

Full scan with all 17 scanner modules, binary analysis, and dependency auditing. Covers workflow security, secret detection, network monitoring, permission auditing, container scanning, OIDC validation, and artifact integrity checks.

17 Scanners Binary Analysis

View Deep Scan Report

Paranoid Zero-Trust Audit

Maximum detection sensitivity with egress validation, /tmp and /dev/shm sweep, cross-platform CI/CD configuration audit, and strict fail thresholds. The most comprehensive scan mode available.

Paranoid Mode Zero Trust

View Paranoid Audit Report

Pipeline Stages

The showcase pipeline runs 8 stages to demonstrate each capability of Supply Chain Guardian.

1Signature Detection
2Deep Multi-Scanner Analysis
3Runtime Behavioral Monitoring
4Exception Engine
5Paranoid Zero-Trust Audit
6Security Tab Integration
7Report Deployment
8Pipeline Summary

How a Supply Chain Attack Works

1

Initial Compromise

Attacker publishes a typosquatted package (reqeusts instead of requests) or compromises a popular GitHub Action (tj-actions/changed-files).

2

Silent Execution

Malicious postinstall script runs during npm install. Obfuscated payload decodes via base64 and executes in the CI runner environment.

3

Credential Theft

Payload reads GITHUB_TOKEN, AWS keys, and CI secrets from environment variables. Data exfiltrated via DNS tunneling or HTTPS to attacker C2 server.

4

Lateral Movement

Stolen tokens used to access private repositories, modify package releases, and inject backdoors into downstream build artifacts.

5

Supply Chain Guardian Detection

SCG identifies the attack at multiple stages: compromised action reference, malicious package in manifest, obfuscated payload, network exfiltration, and runtime behavioral anomaly.

Scanner Modules

Signature Scanner110+ known attack patterns
Dependency AnalyzerCompromised and malicious packages
Permission AuditorLeast-privilege enforcement
Network MonitorReverse shells, C2 callbacks
Secret DetectorHardcoded credentials, API keys
Workflow AnalyzerInjection, unsafe triggers
Cache InspectorPoisoning vectors
Container ScannerImage pinning, privilege escalation
OIDC ValidatorToken scope abuse, identity confusion
Artifact AuditorPath traversal, overwrite, TOCTOU
Binary AnalyzerExecutable detection, entropy analysis
Runtime MonitorProcess behavior, file access
Egress ControllerUnauthorized outbound connections
Injection ScannerScript and expression injection
CI Config AuditorJenkins, GitLab, Azure, CircleCI
Obfuscation DetectorBase64, eval chains, encoded payloads
Exception EngineAllowlist and override management

Resources