Skip to content

GuardRail v1.0.1 — Initial Public Release

Latest
Latest

Choose a tag to compare

View all tags
@heatonb1 heatonb1 released this 01 Apr 23:47
v1.0.1
2b06ae3

What is GuardRail?

Zero-dependency npm supply chain security tool that detects attacks before any advisory exists. Built in response to the March 2026 axios supply chain compromise (GHSA-fw8c-xr5c-95f9).

Install

npm install -g supply-chain-guardrail
guardrail scan

Detection Capabilities

  • Ghost Dependency Detection — flags packages declared in package.json but never imported in source code
  • Script Behavioral Scoring — weighted multi-rule analysis of lifecycle scripts with compound bonuses (network + exec + eval patterns)
  • IOC Database — built-in indicators of compromise for known malicious packages
  • Baseline Drift — Ed25519-signed snapshots detect any change to dependencies or scripts
  • Token Audit — finds mixed-mode OIDC + static token configurations
  • SARIF Output — integrates with GitHub Code Scanning

What's New in 1.0.1

  • Fixed npm bin shebang for global CLI install
  • Ghost dependency detection now works in lockfile-only mode
  • Script scoring compound bonuses (network+exec, network+eval, exec+eval)
  • Ghost deps with install scripts escalate to high severity
  • --json flag outputs structured JSON
Assets 2
Loading