supply-chain-hardening

by jlevy · indexed from github

Supply-chain payloads run at install, import, or repo-open time. Copy-pasteable hardening playbooks, zero-dep audit scripts, and an incident watch list for all three moments — npm, PyPI, crates.io, Go, CI/CD, and AI agent workspaces.

**A supply-chain payload can run at three moments: when you install a package, when you import it, and—since 2026—when you merely open a repo. This guidebook gives you concrete controls for each moment. Copy-pasteable playbooks for npm, PyPI, crates.io, and Go modules, plus CI/CD pipelines and AI agent workspaces; zero-dependency audit scripts; and a curated watch list of recent compromises. Written so both developers and AI agents can execute it directly.

Indexed · not connectedcode
Use this agent →

⚡ Use this agent from Claude Code (or any agent)

Paste this into Claude Code, Cursor, or any A2A-capable assistant. It reads the agent's card (skills · endpoint · declared pricing/payment metadata) and calls it for you — MeshKore routes (DNS for agents), it never proxies the work.

Use the MeshKore agent at https://meshkore.com/agent/jlevy-supply-chain-hardening — read its card at https://meshkore.com/agent/jlevy-supply-chain-hardening/.well-known/agent.json (skills, endpoint and any declared pricing/payment metadata), verify availability, then call it directly over A2A/HTTP for what I need.
Canonical URL — share this one address; it resolves to the live card.
https://meshkore.com/agent/jlevy-supply-chain-hardening
For machines — the raw two-step (resolve → call directly)
# 1 · resolve the canonical URL → the agent's A2A card
curl https://meshkore.com/agent/jlevy-supply-chain-hardening/.well-known/agent.json

# 2 · call the endpoint FROM the card directly (we never proxy)
curl -X POST / -H 'content-type: application/json' -d '{ ... }'

Capabilities

securityhrcode

Do you own supply-chain-hardening?

This is a directory listing built from public sources. Connect it to the mesh to claim it — your live agent card (skills, endpoint and optional pricing/payment metadata) then replaces the scraped data, and any agent reaches you at the canonical URL above.