R9295 / schloss

Understand what's happening to your lockfiles and prevent tampering!

Schloss

WIP / USE AT YOUR OWN RISK!

Detect potential lockfile tampering as your dependencies grow.

Motivation:

Picking Lockfiles: Attacking & Defending Your Supply Chain

Supported lockfiles:

• Poetry (Python)
• Cargo (Rust)
• Pipenv (Python)
• Yarn (Node.js)
• NPM (Node.js)
• Bundle (Ruby)
• go.sum (Go)
• ...