vamp-supply-chain

Overview

vamp-supply-chain is a supply chain security scanner that audits project dependencies for CVE vulnerabilities, typosquatting attacks, and checksum integrity. It automatically detects dependency manifests (requirements.txt, pyproject.toml, setup.cfg, package.json) and queries OSV.dev for known vulnerabilities, performs Levenshtein-distance typosquatting detection against a curated list of 30 popular packages, and verifies package checksums against PyPI metadata. It can also generate Software Bill of Materials (SBOM) in CycloneDX JSON format. Findings are rated CRITICAL to INFO and exported to Console (Rich), JSON, or HTML.

Features

• Automatic dependency manifest discovery: requirements.txt, requirements-*.txt, pyproject.toml ([project].dependencies), setup.cfg ([options].install_requires), package.json (dependencies + devDependencies)
• CVE check via OSV.dev API: POST to https://api.osv.dev/v1/query per package with severity rated CRITICAL/HIGH from CVSS score
• Typosquatting detection: pure-Python Levenshtein distance (no external library) against 30 curated popular packages; distance ≤ 2 triggers HIGH severity finding
• Checksum verification: queries https://pypi.org/pypi/{pkg}/{version}/json and compares .tar.gz SHA-256; unresolved packages flagged as MEDIUM
• SBOM generation (subcommand sbom): CycloneDX JSON with bomFormat, specVersion, serialNumber, per-component purl (pkg:pypi/name@version) and licenses
• Rich console output: per-issue-type panels and a severity summary table
• Export to JSON and HTML (standalone, dark-theme)
• Exit codes for CI/CD pipeline integration

Requirements

• Python 3.9 or later
• rich >= 13.7.0
• aiohttp >= 3.8.0

Installation

pip install vamp-supply-chain
# o con Homebrew:
brew install vampsecure-labs/labs/vamp-supply-chain

git clone https://github.com/Vampsecure-Labs/vamp-supply-chain.git
cd vamp-supply-chain
python3 -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt

Usage

vamp-supply-chain --help

usage: vamp-supply-chain [-h] {scan,sbom} ...

vamp-supply-chain — Supply Chain Security Scanner (VampSecure Labs)

subcommands:
  scan    Scan dependency manifests for CVEs, typosquatting and checksum issues
  sbom    Generate a CycloneDX SBOM from discovered dependencies

Examples

# Scan all dependency manifests in the current directory
vamp-supply-chain scan --path .

# Scan a specific project and export findings to JSON and HTML
vamp-supply-chain scan --path /path/to/project --json results.json --html report.html

# Scan and also emit a CycloneDX SBOM
vamp-supply-chain scan --path . --sbom sbom.json

# Generate SBOM only (no vulnerability check)
vamp-supply-chain sbom --path . --output sbom.json

# Generate SBOM in SPDX format
vamp-supply-chain sbom --path . --output sbom.json --format spdx

CLI Reference

scan

sbom

Output Formats

Exit Codes

Legal Notice

Use exclusively on systems you own or for which you hold explicit written authorization from the system owner. VampSecure Studios assumes no liability for unauthorized use.

Part of VampSecure Labs Toolkit

vamp-supply-chain is one tool in the VampSecure Labs security research toolkit. For the full toolkit including the orchestrator that runs all tools in sequence and aggregates findings into a single engagement report, see:

• Portfolio: github.com/Vampsecure-Labs
• Orchestrator: github.com/Vampsecure-Labs/vamp-orchestrator

© VampSecure Studios — VampSecure Labs Security Research Division

Versión

v1.0 — VampSecure Labs Security Research Division