Supply-Chain Guard

by Ryan

Read-only supply-chain guard for teams with coding agents. Freezes installs to lockfile versions, pins checksums, waits a week before trusting brand-new releases, and scans machines for stealer tricks (.pth hijacks, weird LaunchAgents/cron, plaintext key paths). Treats READMEs and package pages as untrusted data. Never installs or upgrades without the owner's yes.