ai-supply-chain-security

• Analyzed: May 10, 2026, 6:30 AM
• Findings: 1
• Version: 2.1.0
• Hash: 7a03a387c02fbd8e99d2461dfa6e126dae17622c4b87052755deb99c983f0228
• Source: palm
• External report: View on VirusTotal

Findings (1)

The bundle is a comprehensive security scanner designed to detect supply chain attacks, malicious AI assistant hooks (e.g., Claude Code, Cursor), and prompt injection. The core logic in 'ai_scanner.py' and 'auto_scanner.py' uses extensive regex-based rules and a database of known malicious packages to audit local project files for risks like typosquatting, dependency confusion, and dangerous lifecycle scripts. While the code contains many 'dangerous' patterns (e.g., 'curl | bash', 'rm -rf'), they are used strictly for detection purposes. No evidence of data exfiltration, unauthorized remote control, or malicious intent was found; the tool's behavior is entirely consistent with its stated purpose.