<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Implementing Supply Chain Incident Response — API Reference

## npm Incident Commands

```bash
# Check installed version
npm ls pkg-name --json

# Force install safe version
npm install pkg-name@safe-version --save-exact

# Regenerate lockfile
rm package-lock.json && npm install

# Audit after remediation
npm audit --json
```

## pip Incident Commands

```bash
# Check installed version
pip show pkg-name

# Uninstall compromised package
pip uninstall pkg-name -y

# Install safe version
pip install pkg-name==safe-version

# Audit after remediation
pip-audit --format json
```

## SBOM-Based Assessment

```bash
# Find package in SBOM
jq '.components[] | select(.name == "compromised-pkg")' sbom.cdx.json

# Check dependency graph
jq '.dependencies[] | select(.dependsOn[]? | contains("compromised"))' sbom.cdx.json
```

