Feature · Supply-chain guard
Shipped · CI pathCatch a compromised package before it ships.
Dependency changes are checked in CI before they merge. A package that diverges from what it claims to be gets flagged, not waved through.
What it does
A check on your dependency changes, not just your code.
Supply-chain attacks usually land through a dependency, not through code your team wrote. This runs a divergence check against lockfile and package changes as part of your CI pipeline, so a compromised or unexpected package is caught before it reaches a build.
How it works
Runs where your CI already runs.
The check plugs into your existing CI pipeline and evaluates dependency changes against known-good signals. It either passes cleanly or blocks the merge with a specific reason, the same pass/fail discipline as any other CI gate you already trust.
Status
Shipped for the CI path. Distribution-side pieces are roadmap.
The CI-side divergence check is shipped and running today. A few pieces around it are roadmap, not yet available: an npm-compatible registry mirror, a GitHub PR bot for lockfile changes, and a WordPress-specific guard. The underlying OID resolver library is published on npm as open source, but the hosted lookup service behind it is not deployed yet, so do not expect a hosted, real-time resolver check today.
Folded in from the former catalog
- Supply Chain Guard (Hlíf)
- Registry Mirror
- PR Bot
- @synoi/oid-resolver (npm lib)
- Guard for WordPress
Add the check to your next CI run.
Wire the CI-side guard into your pipeline and start catching dependency drift on the next lockfile change.