← Browse
supply-chain
joshualytle ★ 1
supply-chain downloads and diffs the actual released artifacts (npm tarball, PyPI wheel/sdist, crate, pub archive) between old and new dependency versions, verifying digests and analyzing file-level changes without executing code. It identifies new contributors, flags suspicious patterns like install scripts and obfuscated code, and optionally generates summaries via local Ollama.
Install
> /plugin marketplace add joshualytle/Gnomonkit/tree/HEAD/plugins/supply-chain
> /plugin install supply-chain
Source: https://github.com/joshualytle/Gnomonkit/tree/HEAD/plugins/supply-chain
What it's made of
2 skills · 2 hooks
- Commands
- 0
- Agents
- 0
- Skills
- 2
- MCP servers
- 0
- Hooks
- 2 · PostToolUse, PreToolUse
What it needs & plugs into
- API keys
- none
- Paid services
- none detected
- External tools
*)andcygwin*)exceptimportrunpy.run_path(s,run_name='__main__')"sys.argv=sys.argv[1:]sys.exit(0)sys.path[0]=os.path.dirname(s)try:ev=json.load(sys.stdin).get(hook_event_name)try:open(s,rb).close()- Talks to
- nothing external detected
Analyzed . Facts extracted from the plugin's files. Prose generated by claude-haiku-4-5-20251001.
Is this your plugin?
Claim it to keep the card accurate and enter the weekly contest. Requires signing in as the GitHub owner (joshualytle).