Supply Chain Sentinel

Node.js Express React OSV Docker

Overview

Built a Node.js supply-chain security toolkit that combines a CI/CD enforcement CLI with an interactive dependency graph analyzer for identifying vulnerable packages and potential dependency-level attack paths.

The CLI is designed to run directly inside CI/CD pipelines, while the graph analyzer provides developers with visibility into transitive dependencies, vulnerability severity, blast radius, and affected package relationships.

View Repository on GitHub

CI/CD Security CLI

Known Vulnerabilities: Queries OSV.dev for CVEs and GHSAs affecting installed package versions.
Typosquatting Detection: Identifies package names suspiciously similar to popular npm packages using edit-distance analysis.
Package Integrity: Detects non-development dependencies missing integrity hashes in the lockfile.
Unsafe Resolution: Flags dependencies resolved over HTTP instead of HTTPS.
Install Scripts: Detects packages that execute lifecycle scripts such as preinstall and postinstall.
Dependency Pinning: Identifies direct dependencies using loose version ranges such as ^, ~, *, or latest.
Deprecated Packages: Detects packages marked as deprecated in the npm registry.

Dependency Graph Analyzer

Dependency Resolution: Parses npm lockfiles and builds the complete transitive dependency graph using Node.js module-resolution rules.
Vulnerability Mapping: Cross-references resolved package versions against OSV.dev vulnerability data.
Blast Radius: Calculates how many packages transitively depend on each vulnerable package.
Attack Paths: Identifies which vulnerable packages each dependency is exposed to through the dependency graph.
Risk Prioritization: Ranks packages using vulnerability severity and blast-radius impact to highlight high-leverage remediation targets.

Security Detection

CRITICAL: Known critical vulnerabilities
HIGH: Typosquatting and insecure HTTP dependency sources
MEDIUM: Missing integrity metadata and install scripts
LOW: Unpinned and deprecated dependencies

CI/CD Integration

GitHub Actions: Includes a drop-in workflow for scanning dependencies on pushes, pull requests, and scheduled runs.
GitLab CI: Provides a reusable GitLab pipeline template.
Jenkins: Includes a pipeline stage for automated supply-chain scanning.
Configurable Enforcement: CI pipelines can fail based on a configurable severity threshold.

Architecture

package.json + package-lock.json

↓

Sentinel CLI → Detectors → OSV / npm Registry → CI/CD Result

GitHub Repository → Backend → Dependency Graph → React Visualizer

The CLI provides the enforcement path for automated pipelines, while the graph analyzer serves as a developer-facing tool for exploring dependency relationships and security impact.

Technology Stack

CLI: Node.js, Commander, npm lockfile parsing, OSV API
Backend: Node.js, Express, PostgreSQL
Frontend: React 19, TypeScript, Vite, Tailwind CSS, react-force-graph-2d
Security: OSV.dev, npm Registry, dependency graph analysis, supply-chain risk detection
Infrastructure: Docker Compose, GitHub Actions, GitLab CI, Jenkins

CLI Output

Text: Human-readable colored terminal output.
JSON: Machine-readable output for automation and custom tooling.

Current Limitations

Only package-lock.json is parsed directly; Yarn and pnpm projects currently rely on registry-based fallback resolution.
npm workspace symlink and monorepo hoisting scenarios are not fully supported.
Private npm registry authentication is not currently implemented.
Dependency diffing and automatic pull-request commenting are planned features.