Supply Chain Scanner

Local-first vulnerability scanner for project dependencies, developer tools, and IDE extensions.
Uses multi-source intelligence (OSV, NVD, GHSA, Sonatype) with KEV/EPSS prioritization.

No API key required for default usage.

Public repo: https://github.com/DevInder1/supply-chain-scanner-public

Install (plug and play)

Python (recommended)

pip install devinder-supply-chain-scanner

supply-chain-scanner --scan all --project-path . --output-dir scanner-output

npm (Node wrapper)

Requires Python 3.10+ and the pip package above.

npm install -g @devinder1/supply-chain-scanner-cli

supply-chain-scanner --scan project --project-path .

Use in your own Python app

from scanner import run_scan

summary = run_scan(
    project_path=".",
    scan="all",
    run_profile="full",  # no API key required
    output_dir="scanner-output",
)
print(summary["summary"])

Scan profiles

Desktop app

cd apps/desktop
npm install
npm run start

Development

git clone https://github.com/DevInder1/supply-chain-scanner-public.git
cd supply-chain-scanner-public
python3 -m pip install -e .
supply-chain-scanner --help
python3 -m unittest scanner.tests.test_matcher_ranges -v

CLI contract: docs/cli-contract.md
Publishing: docs/PUBLISHING.md

Optional API keys (power users)

Set in .env or environment variables.

License

MIT — see LICENSE