<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing Supply Chain Malware — API Reference

## npm Security

### Audit

```bash
npm audit                              # Check for known vulnerabilities
npm audit --json                       # JSON output
npm audit fix                          # Auto-fix where possible
npm audit signatures                   # Verify registry signatures
```

### Package Inspection

```bash
npm pack <package>@<version>           # Download tarball without installing
npm view <package> dist.integrity      # Get integrity hash
npm view <package> repository.url      # Check source repo
npm view <package> scripts             # View install scripts
npm view <package> maintainers         # List maintainers
```

### Lockfile Verification

```bash
npm ci                                 # Clean install from lockfile
npm ci --ignore-scripts                # Skip install hooks
```

## pip-audit (Python)

```bash
pip install pip-audit
pip-audit                              # Audit installed packages
pip-audit -r requirements.txt          # Audit requirements file
pip-audit --format json                # JSON output
pip-audit --require-hashes -r requirements.txt  # Verify hashes
```

## Sigstore / cosign

```bash
# Verify container image signature
cosign verify --key cosign.pub ghcr.io/org/image:tag

# Verify blob signature
cosign verify-blob --signature sig --certificate cert artifact.tar.gz

# Sign an artifact
cosign sign-blob --output-signature sig.sig artifact.tar.gz
```

## SLSA Verification

```bash
# Install verifier
go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@latest

# Verify artifact provenance
slsa-verifier verify-artifact artifact.tar.gz \
    --provenance-path provenance.intoto.jsonl \
    --source-uri github.com/org/repo \
    --source-tag v1.2.3
```

## OpenSSF Scorecard

```bash
# Check project security score
scorecard --repo=github.com/org/repo --format json

# Key checks:
# - Code-Review: Are PRs reviewed?
# - Branch-Protection: Is main branch protected?
# - Signed-Releases: Are releases signed?
# - Token-Permissions: Are GitHub tokens least-privilege?
# - Dependency-Update-Tool: Is Dependabot/Renovate active?
```

## Socket.dev (npm)

```bash
# CLI tool for npm package analysis
npx socket optimize                    # Analyze package.json
npx socket report create package.json  # Full supply chain report
```

## Reproducible Builds

```bash
# Build locally and compare against published
git clone https://github.com/org/repo && cd repo
git checkout v1.2.3

# Build
npm ci && npm run build

# Compare hashes
sha256sum dist/* > local.txt
npm pack org-package@1.2.3
tar xzf org-package-1.2.3.tgz
sha256sum package/dist/* > published.txt
diff local.txt published.txt
```
