{"name":"Supply Chain Monitor: Automated Detection of Package Compromises","description":"Supply Chain Monitor is a powerful tool by Elastic designed to automatically detect supply chain compromises in popular PyPI and npm packages. It polls registries for new releases, diffs them against predecessors, and uses an LLM via Cursor Agent CLI to classify changes as benign or malicious. Malicious findings trigger immediate Slack alerts, enhancing security for your software dependencies.","github":"https://github.com/elastic/supply-chain-monitor","url":"https://osrepos.com/repo/elastic-supply-chain-monitor","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/elastic-supply-chain-monitor","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/elastic-supply-chain-monitor.md","json":"https://osrepos.com/repo/elastic-supply-chain-monitor.json","topics":["Python","Supply Chain Security","Package Manager","PyPI","npm","LLM","Security Monitoring","Open Source"],"keywords":["Python","Supply Chain Security","Package Manager","PyPI","npm","LLM","Security Monitoring","Open Source"],"stars":null,"summary":"Supply Chain Monitor is a powerful tool by Elastic designed to automatically detect supply chain compromises in popular PyPI and npm packages. It polls registries for new releases, diffs them against predecessors, and uses an LLM via Cursor Agent CLI to classify changes as benign or malicious. Malicious findings trigger immediate Slack alerts, enhancing security for your software dependencies.","content":"## Introduction\n\nThe **Supply Chain Monitor** by Elastic offers an automated solution for safeguarding your software dependencies against supply chain attacks. This Python-based tool continuously monitors the top PyPI and npm packages for new releases. When a new version is detected, it performs a detailed diff against the previous release and leverages an LLM (via Cursor Agent CLI) to analyze the changes. The LLM is specifically prompted to identify suspicious patterns, classifying diffs as either benign or malicious. If a malicious change is identified, the system automatically triggers a Slack alert, providing early warning of potential compromises.\n\nThe monitor is designed to look for various indicators of compromise, including obfuscated code, unexpected network calls, file system writes to sensitive locations, process spawning, credential exfiltration, and typosquatting.\n\n## Installation\n\nTo get started with Supply Chain Monitor, you'll need Python 3.9+ and the Cursor Agent CLI.\n\n### Prerequisites\n\n*   **Python 3.9+**: Install runtime dependencies using `pip install -r requirements.txt`. The `requirements.txt` file is located in the repository.\n*   **Cursor Agent CLI**: This is the standalone `agent` binary, not the IDE.\n\n### Installing Cursor Agent CLI\n\n**Windows (PowerShell):**\npowershell\nirm 'https://cursor.com/install?win32=true' | iex\n\n\n**macOS / Linux:**\nbash\ncurl https://cursor.com/install -fsS | bash\n\n\nVerify your installation with:\nbash\nagent --version\n\n\nYou must also authenticate with Cursor using `agent login` or by setting the `CURSOR_API_KEY` environment variable.\n\n### Slack Configuration\n\nFor receiving alerts, configure Slack by placing your bot token in `etc/slack.json`:\n\n\n{\n    \"url\": \"https://hooks.slack.com/services/...\",\n    \"bot_token\": \"xoxb-...\",\n    \"channel\": \"C01XXXXXXXX\"\n}\n\n\nEnsure your bot has `chat:write` scope on the target channel, and `channel` is set to the Slack channel ID where alerts should be posted.\n\n## Examples\n\nThe `monitor.py` script is the main orchestrator. Here are some quick start commands:\n\n*   **One-shot analysis**: Analyze releases from the last approximately 10 minutes, then exit.\n    bash\n    python monitor.py --once\n    \n\n*   **Continuous monitoring**: Monitor the top 1000 packages from both ecosystems, polling every 5 minutes.\n    bash\n    python monitor.py --top 1000 --interval 300\n    \n\n*   **Production setup**: Monitor the top 15000 packages, polling every 5 minutes, with Slack alerts enabled.\n    bash\n    python monitor.py --top 15000 --interval 300 --slack\n    \n\n*   **npm only**: Monitor the top 5000 npm packages.\n    bash\n    python monitor.py --no-pypi --npm-top 5000\n    \n\n*   **PyPI only**: Monitor PyPI packages exclusively.\n    bash\n    python monitor.py --no-npm\n    \n\n## Why Use It\n\nSupply Chain Monitor provides crucial benefits for maintaining the security of your software projects:\n\n*   **Proactive Threat Detection**: It continuously monitors popular package registries, identifying potential compromises before they can impact your systems.\n*   **LLM-Powered Analysis**: By leveraging an LLM, the tool can intelligently analyze code differences, detecting sophisticated obfuscation, malicious network calls, and other advanced attack techniques that might evade traditional static analysis.\n*   **Real-time Alerts**: Immediate Slack notifications for malicious findings enable rapid response to security incidents.\n*   **Broad Coverage**: Monitors both PyPI and npm, covering a vast array of open-source dependencies.\n*   **Lightweight Operation**: Designed to be efficient, making only a few API calls per poll interval and per new release, minimizing overhead.\n\n## Links\n\n*   **GitHub Repository**: [https://github.com/elastic/supply-chain-monitor](https://github.com/elastic/supply-chain-monitor){target=\"_blank\"}","metrics":{"detailViews":5,"githubClicks":7},"dates":{"published":null,"modified":"2026-05-23T00:40:51.000Z"}}