git log --oneline -20 -- package.json package-lock.json
git diff HEAD~10 -- package.json package-lock.json

git log --oneline -20 -- requirements.txt requirements.lock setup.py pyproject.toml
pip-audit --require-hashes -r requirements.txt

git log --oneline -20 -- pom.xml build.gradle
mvn dependency:tree -DoutputType=dot

cat package-lock.json | python3 -c "
import json, sys
data = json.load(sys.stdin)
packages = data.get('packages', data.get('dependencies', {}))
for name, info in packages.items():
    version = info.get('version', 'unknown')
    resolved = info.get('resolved', 'N/A')
    integrity = info.get('integrity', 'N/A')
    print(f'{name} => {version}')
    print(f'  Resolved: {resolved}')
    print(f'  Integrity: {integrity[:40]}...')
"

diff <(pip freeze | sort) requirements-lock.txt
pip-audit --fix --dry-run

npm audit --json | python3 -c "
import json, sys
data = json.load(sys.stdin)
vulns = data.get('vulnerabilities', {})
for name, info in vulns.items():
    severity = info.get('severity', 'unknown')
    via = info.get('via', [])
    fix_available = info.get('fixAvailable', False)
    print(f'[{severity.upper()}] {name}')
    for v in via:
        if isinstance(v, dict):
            print(f'  Title: {v.get(\"title\", \"N/A\")}')
            print(f'  URL: {v.get(\"url\", \"N/A\")}')
    print(f'  Fix Available: {fix_available}')
    print()
"

pip-audit --format json | python3 -c "
import json, sys
data = json.load(sys.stdin)
for dep in data.get('dependencies', []):
    name = dep.get('name', '')
    version = dep.get('version', '')
    vulns = dep.get('vulns', [])
    if vulns:
        print(f'[VULNERABLE] {name}=={version}')
        for v in vulns:
            print(f'  ID: {v.get(\"id\", \"N/A\")}')
            print(f'  Description: {v.get(\"description\", \"N/A\")[:80]}')
"

git log --all --oneline --diff-filter=ACMR -- '.github/workflows/'

for commit in $(git log --all --oneline -- '.github/workflows/' | head -10 | awk '{print $1}'); do
    echo "=== Commit: $commit ==="
    git show --stat $commit -- '.github/workflows/'
    git show $commit -- '.github/workflows/' | head -50
    echo ""
done

git log --all --oneline -- '.github/workflows/' | while read hash msg; do
    echo "--- $hash: $msg ---"
    git show $hash -- '.github/workflows/' 2>/dev/null | grep -E '^\+.*uses:|^\+.*run:|^\+.*secrets\.' | head -20
done

if command -v gh &> /dev/null; then
    gh run list --limit 10
    for run_id in $(gh run list --limit 5 --json databaseId -q '.[].databaseId'); do
        echo "=== Run ID: $run_id ==="
        gh run view $run_id --log 2>/dev/null | grep -iE 'upload|download|secret|token|curl|wget|eval|exec|base64|reverse' | head -20
    done
fi

git log --show-signature --oneline -20

git log --format='%H %G? %GS %GK %aN <%aE>' -20

cosign verify-blob \
    --bundle ./artifact.bundle \
    --certificate-identity=https://github.com/owner/repo/.github/workflows/build.yml@refs/heads/main \
    --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
    ./artifact

cosign verify \
    --certificate-identity=user@example.com \
    --certificate-oidc-issuer=https://accounts.google.com \
    ghcr.io/owner/image:tag

rekor-cli search --email user@example.com
rekor-cli get --log-index <log_index>

if command -v gh &> /dev/null; then
    gh api user --jq '{login: .login, two_factor_enabled: .two_factor_enabled, created_at: .created_at}'
fi

gh api user/tokens --jq '.[] | {id: .id, name: .name, scopes: .scopes, created_at: .created_at, last_used_at: .last_used_at}' 2>/dev/null

strings SolarWinds.Orion.Core.BusinessLayer.dll | grep -iE 'avsvm|update|cdn|solr|json'

sha256sum SolarWinds.Orion.Core.BusinessLayer.dll

volatility -f memory.dump --profile=Win10x64_18362 malfind | grep -A 20 "SolarWinds"

volatility -f memory.dump --profile=Win10x64_18362 netscan | grep -iE 'avsvm|azure|amazon'

volatility -f memory.dump --profile=Win10x64_18362 handles -p $(pgrep -f SolarWinds) | grep -iE 'File|Section|Event'

import requests

c2_indicators = [
    "avsvmcloud.com",
    "freescanonline.com",
    "deftsecurity.com",
    "thedoccloud.com",
    "virtualsitting.com",
    "websitetheme.com",
    "highstechlabs.com",
    "azureonline.cloud",
    "decolourmachines.com",
]

for domain in c2_indicators:
    try:
        resp = requests.get(f"https://{domain}", timeout=10, verify=True)
        print(f"[{resp.status_code}] {domain} => {resp.headers.get('Server', 'N/A')}")
    except requests.exceptions.RequestException as e:
        print(f"[ERROR] {domain} => {str(e)[:80]}")

CHIPSEC 使用示例：
chipsec_main --module common.secureboot.variables
chipsec_main --module common.winring0
chipsec_main --module common.spi

# Windows 环境下检查驱动签名
sigcheck.exe -accepteula -vt -u C:\Windows\System32\drivers\*.sys 2>/dev/null

import subprocess
import json

def check_driver_signatures(driver_path):
    result = subprocess.run(
        ["sigcheck.exe", "-accepteula", "-vt", "-u", driver_path],
        capture_output=True, text=True, timeout=30
    )
    output = result.stdout
    signed_drivers = []
    unsigned_drivers = []
    for line in output.split('\n'):
        if 'Signed' in line and 'Unsigned' not in line:
            signed_drivers.append(line.strip())
        elif 'Unsigned' in line:
            unsigned_drivers.append(line.strip())
    return {
        "signed": signed_drivers,
        "unsigned": unsigned_drivers,
        "total_signed": len(signed_drivers),
        "total_unsigned": len(unsigned_drivers),
    }

mokutil --sb-state

# Linux 下检查 Secure Boot 状态
dmesg | grep -i 'secure boot'
dmesg | grep -i 'lockdown'

# 使用 CHIPSEC 检查 Secure Boot 配置
chipsec_main --module common.secureboot.enabled
chipsec_main --module common.secureboot.setup

python3 << 'PYTHON'
import json
import os
import hashlib

def analyze_supply_chain_evidence(project_dir):
    evidence = {
        "critical": [],
        "suspicious": [],
        "watch": []
    }

    pkg_json_path = os.path.join(project_dir, "package.json")
    if os.path.exists(pkg_json_path):
        with open(pkg_json_path) as f:
            pkg = json.load(f)

        scripts = pkg.get("scripts", {})
        for hook in ["preinstall", "postinstall", "prepare", "prepublish"]:
            if hook in scripts:
                cmd = scripts[hook]
                if any(keyword in cmd for keyword in ["eval", "exec", "curl", "wget", "base64", "child_process"]):
                    evidence["critical"].append({
                        "type": "MALICIOUS_SCRIPT",
                        "hook": hook,
                        "command": cmd,
                        "severity": "CRITICAL",
                        "mitre": "T1195.002"
                    })
                elif any(keyword in cmd for keyword in ["http", "https", "request", "fetch"]):
                    evidence["suspicious"].append({
                        "type": "SUSPICIOUS_NETWORK",
                        "hook": hook,
                        "command": cmd,
                        "severity": "HIGH",
                        "mitre": "T1195.002"
                    })

        deps = {**pkg.get("dependencies", {}), **pkg.get("devDependencies", {})}
        for name, version in deps.items():
            if version.startswith("http") or version.startswith("git+"):
                evidence["suspicious"].append({
                    "type": "URL_DEPENDENCY",
                    "package": name,
                    "version": version,
                    "severity": "HIGH",
                    "mitre": "T1195.002"
                })

    return evidence

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "."
    result = analyze_supply_chain_evidence(target)
    print(json.dumps(result, indent=2, ensure_ascii=False))
PYTHON

title: Suspicious npm install Network Activity
id: 5a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious network requests during npm package installation
references:
  - https://attack.mitre.org/techniques/T1195/002/
author: x7peeps
date: 2026/07/05
tags:
  - attack.supply_chain
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_npm_install:
    CommandLine|contains|all:
      - 'npm'
      - 'install'
  selection_suspicious_command:
    CommandLine|contains:
      - 'curl'
      - 'wget'
      - 'Invoke-WebRequest'
      - 'Net.WebClient'
      - 'base64'
      - 'eval'
      - 'exec'
  condition: selection_npm_install and selection_suspicious_command
level: high

title: GitHub Actions Workflow Modified
id: 6b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects modifications to GitHub Actions workflow files
references:
  - https://attack.mitre.org/techniques/T1195/002/
author: x7peeps
date: 2026/07/05
tags:
  - attack.supply_chain
  - attack.t1195.002
logsource:
  category: file_event
  product: linux
detection:
  selection_workflow_create:
    TargetFilename|contains|all:
      - '.github/workflows/'
      - '.yml'
  selection_workflow_modify:
    TargetFilename|contains|all:
      - '.github/workflows/'
  filter_legitimate:
    TargetFilename|endswith:
      - '.github/workflows/ci.yml'
  condition: selection_workflow_create or (selection_workflow_modify and not filter_legitimate)
level: medium

#!/bin/bash
SCAN_DIR="${1:-.}"
REPORT_FILE="supply_chain_audit_$(date +%Y%m%d_%H%M%S).txt"

echo "========================================" | tee "$REPORT_FILE"
echo " Supply Chain Security Audit Report" | tee -a "$REPORT_FILE"
echo " Scan Directory: $SCAN_DIR" | tee -a "$REPORT_FILE"
echo " Scan Time: $(date)" | tee -a "$REPORT_FILE"
echo "========================================" | tee -a "$REPORT_FILE"

echo "" | tee -a "$REPORT_FILE"
echo "[Phase 1] Checking package.json for suspicious scripts..." | tee -a "$REPORT_FILE"
find "$SCAN_DIR" -name "package.json" -not -path "*/node_modules/*" | while read pkgfile; do
    echo "File: $pkgfile" | tee -a "$REPORT_FILE"
    python3 -c "
import json, sys
with open('$pkgfile') as f:
    data = json.load(f)
scripts = data.get('scripts', {})
for hook, cmd in scripts.items():
    if any(x in cmd for x in ['eval', 'exec', 'curl', 'wget', 'base64', 'child_process', 'http://', 'https://']):
        print(f'  [CRITICAL] {hook}: {cmd}')
    elif any(x in cmd for x in ['require', 'import', 'spawn']):
        print(f'  [SUSPICIOUS] {hook}: {cmd}')
" 2>/dev/null | tee -a "$REPORT_FILE"
done

echo "" | tee -a "$REPORT_FILE"
echo "[Phase 2] Checking for URL-based dependencies..." | tee -a "$REPORT_FILE"
find "$SCAN_DIR" -name "package.json" -not -path "*/node_modules/*" | while read pkgfile; do
    grep -E '"(http|git\+|git://|ssh://)' "$pkgfile" | while read line; do
        echo "  [SUSPICIOUS] $pkgfile: $line" | tee -a "$REPORT_FILE"
    done
done

echo "" | tee -a "$REPORT_FILE"
echo "[Phase 3] Checking for hidden GitHub workflows..." | tee -a "$REPORT_FILE"
find "$SCAN_DIR" -path "*/.github/workflows/*.yml" -o -path "*/.github/workflows/*.yaml" | while read wf; do
    echo "  Workflow: $wf" | tee -a "$REPORT_FILE"
    grep -n "uses:" "$wf" | grep -vE "actions/|github/|peaceiris/|codecov/|coverallsapp/" | while read line; do
        echo "    [SUSPICIOUS] Third-party action: $line" | tee -a "$REPORT_FILE"
    done
done

echo "" | tee -a "$REPORT_FILE"
echo "[Phase 4] Checking requirements.txt for suspicious entries..." | tee -a "$REPORT_FILE"
find "$SCAN_DIR" -name "requirements.txt" | while read reqfile; do
    grep -nE '(http://|https://|git\+|git://)' "$reqfile" | while read line; do
        echo "  [SUSPICIOUS] $reqfile: $line" | tee -a "$REPORT_FILE"
    done
done

echo "" | tee -a "$REPORT_FILE"
echo "[Phase 5] Git history analysis for workflow changes..." | tee -a "$REPORT_FILE"
cd "$SCAN_DIR" 2>/dev/null && git log --all --oneline --diff-filter=ACMR -- '.github/workflows/' | head -20 | while read line; do
    echo "  $line" | tee -a "$REPORT_FILE"
done

echo "" | tee -a "$REPORT_FILE"
echo "Audit Complete. Report saved to: $REPORT_FILE" | tee -a "$REPORT_FILE"

import subprocess
import json
import sys
import os

def generate_sbom(target, output_format="cyclonedx-json"):
    result = subprocess.run(
        ["syft", target, "-o", output_format],
        capture_output=True, text=True, timeout=300
    )
    if result.returncode != 0:
        print(f"[ERROR] SBOM generation failed: {result.stderr[:200]}")
        return None
    return result.stdout

def scan_vulnerabilities(sbom_path):
    result = subprocess.run(
        ["grype", sbom_path, "-o", "json"],
        capture_output=True, text=True, timeout=300
    )
    if result.returncode != 0:
        print(f"[ERROR] Vulnerability scan failed: {result.stderr[:200]}")
        return None
    return json.loads(result.stdout)

def verify_signatures(image_ref):
    result = subprocess.run(
        ["cosign", "verify", "--output", "json", image_ref],
        capture_output=True, text=True, timeout=60
    )
    return {
        "verified": result.returncode == 0,
        "output": result.stdout[:500],
        "error": result.stderr[:200] if result.returncode != 0 else None
    }

def main():
    target = sys.argv[1] if len(sys.argv) > 1 else "."
    print(f"[*] Generating SBOM for: {target}")
    sbom_json = generate_sbom(target)
    if not sbom_json:
        sys.exit(1)

    sbom_file = "sbom_output.json"
    with open(sbom_file, "w") as f:
        f.write(sbom_json)
    print(f"[+] SBOM saved to {sbom_file}")

    sbom_data = json.loads(sbom_json)
    artifacts = sbom_data.get("artifacts", [])
    print(f"[+] Total packages found: {len(artifacts)}")

    print(f"[*] Scanning for vulnerabilities...")
    vuln_data = scan_vulnerabilities(sbom_file)
    if vuln_data:
        matches = vuln_data.get("matches", [])
        print(f"[+] Total vulnerabilities found: {len(matches)}")

        severity_count = {"Critical": 0, "High": 0, "Medium": 0, "Low": 0, "Negligible": 0}
        for match in matches:
            severity = match.get("vulnerability", {}).get("severity", "Unknown")
            severity_count[severity] = severity_count.get(severity, 0) + 1

        print("\n[*] Vulnerability Summary:")
        for sev, count in sorted(severity_count.items(), key=lambda x: x[1], reverse=True):
            if count > 0:
                print(f"    {sev}: {count}")

        critical_high = [m for m in matches if m.get("vulnerability", {}).get("severity") in ("Critical", "High")]
        if critical_high:
            print(f"\n[!] Critical/High vulnerabilities requiring immediate attention:")
            for match in critical_high[:10]:
                vuln = match.get("vulnerability", {})
                artifact = match.get("artifact", {})
                print(f"    [{vuln.get('severity')}] {artifact.get('name')}=={artifact.get('version')}")
                print(f"      ID: {vuln.get('id')}")
                print(f"      Fix: {vuln.get('fix', {}).get('versions', ['N/A'])}")

    if len(sys.argv) > 2:
        image = sys.argv[2]
        print(f"\n[*] Verifying signatures for: {image}")
        sig_result = verify_signatures(image)
        print(f"    Verified: {sig_result['verified']}")
        if sig_result["error"]:
            print(f"    Error: {sig_result['error']}")

if __name__ == "__main__":
    main()

rule NPM_Supply_Chain_Poison_Generic {
    meta:
        description = "Detects generic npm supply chain poisoning patterns"
        author = "x7peeps"
        date = "2026-07-05"
        reference = "https://attack.mitre.org/techniques/T1195/002/"
        mitre_attack = "T1195.002"
    strings:
        $postinstall_eval = /postinstall.*eval\s*\(/
        $postinstall_exec = /postinstall.*exec\s*\(/
        $curl_obfuscated = /curl\s+.*\$\{.*\}/
        $wget_download = /wget\s+.*http/
        $env_exfil = /process\.env.*fetch\s*\(/
        $npmrc_theft = /\.npmrc/
        $ssh_key = /\.ssh\/id_/
        $base64_decode = /atob\s*\(|Buffer\.from\s*\(.*base64/
        $reverse_shell = /require\s*\(\s*['"]child_process['"]\s*\)\s*\.\s*(?:spawn|exec)/
    condition:
        2 of them
}

rule Python_Supply_Chain_Poison_Generic {
    meta:
        description = "Detects generic Python supply chain poisoning patterns"
        author = "x7peeps"
        date = "2026-07-05"
        reference = "https://attack.mitre.org/techniques/T1195/002/"
        mitre_attack = "T1195.002"
    strings:
        $setup_py_exec = "exec("
        $setup_py_system = "os.system("
        $setup_py_subprocess = "subprocess.Popen("
        $setup_py_requests = "requests.post("
        $env_exfil = /environ\s*\[/
        $base64_decode = "base64.b64decode("
        $eval_exec = "eval(__import__('"
        $reverse_shell = /socket\.connect\s*\(/
        $pip_install_hook = /pip.*install.*--force/
        $hidden_import = /__import__\s*\(/
    condition:
        2 of them
}

rule SolarWinds_SUNBURST_Strings {
    meta:
        description = "Detects SUNBURST backdoor string indicators"
        author = "x7peeps"
        date = "2026-07-05"
        reference = "https://attack.mitre.org/techniques/T1195/002/"
        mitre_attack = "T1195.002"
    strings:
        $c2_domain = "avsvmcloud.com"
        $dll_name = "SolarWinds.Orion.Core.BusinessLayer.dll"
        $mutex_prefix = "Mutex_"
        $dns_pattern = /[a-z]{8,15}\.(avsvmcloud|freescanonline|deftsecurity|thedoccloud|virtualsitting|websitetheme|highstechlabs)\.com/
    condition:
        $c2_domain or $dll_name or 2 of ($dns_pattern, $mutex_prefix)
}

# 检测 SUNBURST 后门的 DNS 特征
# 后门生成的子域名格式：[base32编码的主机信息].avsvmcloud.com
python3 << 'PYTHON'
import base64

def decode_sunburst_subdomain(subdomain):
    encoded_part = subdomain.split('.')[0]
    padded = encoded_part + '=' * (8 - len(encoded_part) % 8)
    try:
        decoded = base64.b32decode(padded)
        return decoded.hex()
    except Exception:
        return "DECODE_FAILED"

suspicious_domains = [
    "dnsyncUpdate.avsvmcloud.com",
    "freescanonline.com",
    "deftsecurity.com",
]

for domain in suspicious_domains:
    parts = domain.split('.')
    if len(parts) > 2:
        sub = parts[0]
        decoded = decode_sunburst_subdomain(sub)
        print(f"[INFO] {domain} => decoded: {decoded}")
PYTHON

# 检测是否安装了受影响版本
xz --version
dpkg -l | grep xz 2>/dev/null
rpm -qa | grep xz 2>/dev/null

# 检查 liblzma 是否被注入了后门
# 后门通过 RSA 公钥验证攻击者的连接
strings /usr/lib/liblzma.so.5.6.0 | grep -iE 'id_rsa|shah|liblzma| LZMA_API'

import subprocess
import re

def check_xz_backdoor():
    result = subprocess.run(["ldd", "/usr/sbin/sshd"], capture_output=True, text=True)
    sshd_libs = result.stdout

    if "liblzma" in sshd_libs:
        print("[!] sshd links against liblzma - potential backdoor exposure")
        liblzma_path = re.search(r'liblzma\.so\S* => (\S+)', sshd_libs)
        if liblzma_path:
            path = liblzma_path.group(1)
            strings_result = subprocess.run(
                ["strings", path], capture_output=True, text=True
            )
            indicators = ["id_rsa", "sha256", "RSA_public", "lzma_implode"]
            for indicator in indicators:
                if indicator in strings_result.stdout:
                    print(f"  [CRITICAL] Found backdoor indicator: {indicator}")
            version_check = subprocess.run(["xz", "--version"], capture_output=True, text=True)
            version = version_check.stdout.strip()
            print(f"  [INFO] XZ version: {version}")
            if "5.6.0" in version or "5.6.1" in version:
                print("  [CRITICAL] Running vulnerable version!")
    else:
        print("[+] sshd does not link against liblzma")

check_xz_backdoor()

# 检查项目是否依赖了 event-stream
npm ls event-stream 2>/dev/null

# 检查 flatmap-stream 是否被安装
ls -la node_modules/flatmap-stream/ 2>/dev/null

# 查看 event-stream 的历史版本变更
git log --all --oneline -- node_modules/event-stream/package.json 2>/dev/null

supply_chain_security_policy:
  dependency_management:
    - 使用 lockfile 锁定所有依赖版本
    - 启用 npm audit / pip-audit 自动扫描
    - 定期运行 OWASP Dependency-Check
    - 维护私有仓库镜像，禁止直接访问公共仓库
  sbom_management:
    - 每次发布生成 SBOM（使用 Syft）
    - SBOM 存储在安全的仓库中
    - 定期使用 Grype 扫描现有 SBOM
    - 建立 SBOM 签名和分发流程
  code_signing:
    - 使用 Sigstore 进行代码签名
    - 所有构建产物必须附带签名
    - 使用 Rekor 透明日志记录所有签名
    - 建立签名验证的强制性策略
  ci_cd_security:
    - 启用分支保护规则
    - 限制第三方 Action 的使用
    - 审查所有 workflow 变更
    - 使用 OIDC 而非长期 token
  monitoring:
    - 部署 Sigma 规则到 SIEM
    - 监控依赖变更和仓库修改
    - 设置新版本发布通知
    - 建立供应链安全事件响应流程

import subprocess
import json
import hashlib
import os
from datetime import datetime

class SupplyChainMonitor:
    def __init__(self, project_dir):
        self.project_dir = project_dir
        self.baseline_file = os.path.join(project_dir, ".supply-chain-baseline.json")
        self.findings = []

    def load_baseline(self):
        if os.path.exists(self.baseline_file):
            with open(self.baseline_file) as f:
                return json.load(f)
        return {"lockfile_hashes": {}, "workflow_hashes": {}, "last_scan": None}

    def save_baseline(self, baseline):
        with open(self.baseline_file, "w") as f:
            json.dump(baseline, f, indent=2)

    def calculate_file_hash(self, filepath):
        sha256_hash = hashlib.sha256()
        with open(filepath, "rb") as f:
            for byte_block in iter(lambda: f.read(4096), b""):
                sha256_hash.update(byte_block)
        return sha256_hash.hexdigest()

    def check_lockfile_integrity(self, baseline):
        lockfiles = [
            "package-lock.json", "yarn.lock", "pnpm-lock.yaml",
            "requirements.lock", "Pipfile.lock"
        ]
        for lockfile in lockfiles:
            path = os.path.join(self.project_dir, lockfile)
            if os.path.exists(path):
                current_hash = self.calculate_file_hash(path)
                saved_hash = baseline["lockfile_hashes"].get(lockfile)
                if saved_hash and saved_hash != current_hash:
                    self.findings.append({
                        "type": "LOCKFILE_MODIFIED",
                        "file": lockfile,
                        "old_hash": saved_hash[:16],
                        "new_hash": current_hash[:16],
                        "severity": "HIGH",
                        "timestamp": datetime.now().isoformat()
                    })
                baseline["lockfile_hashes"][lockfile] = current_hash

    def check_workflow_integrity(self, baseline):
        workflows_dir = os.path.join(self.project_dir, ".github", "workflows")
        if not os.path.isdir(workflows_dir):
            return
        for filename in os.listdir(workflows_dir):
            if filename.endswith((".yml", ".yaml")):
                path = os.path.join(workflows_dir, filename)
                current_hash = self.calculate_file_hash(path)
                saved_hash = baseline["workflow_hashes"].get(filename)
                if saved_hash and saved_hash != current_hash:
                    self.findings.append({
                        "type": "WORKFLOW_MODIFIED",
                        "file": filename,
                        "old_hash": saved_hash[:16],
                        "new_hash": current_hash[:16],
                        "severity": "CRITICAL",
                        "timestamp": datetime.now().isoformat()
                    })
                baseline["workflow_hashes"][filename] = current_hash

    def check_new_dependencies(self, baseline):
        pkg_json = os.path.join(self.project_dir, "package.json")
        if not os.path.exists(pkg_json):
            return
        with open(pkg_json) as f:
            pkg = json.load(f)
        all_deps = {}
        for dep_type in ["dependencies", "devDependencies", "optionalDependencies"]:
            for name, version in pkg.get(dep_type, {}).items():
                all_deps[name] = {"version": version, "type": dep_type}
        saved_deps = baseline.get("dependencies", {})
        new_deps = set(all_deps.keys()) - set(saved_deps.keys())
        removed_deps = set(saved_deps.keys()) - set(all_deps.keys())
        for dep in new_deps:
            self.findings.append({
                "type": "NEW_DEPENDENCY",
                "package": dep,
                "version": all_deps[dep]["version"],
                "dep_type": all_deps[dep]["type"],
                "severity": "MEDIUM",
                "timestamp": datetime.now().isoformat()
            })
        for dep in removed_deps:
            self.findings.append({
                "type": "REMOVED_DEPENDENCY",
                "package": dep,
                "severity": "LOW",
                "timestamp": datetime.now().isoformat()
            })
        baseline["dependencies"] = all_deps

    def run_full_scan(self):
        baseline = self.load_baseline()
        self.check_lockfile_integrity(baseline)
        self.check_workflow_integrity(baseline)
        self.check_new_dependencies(baseline)
        baseline["last_scan"] = datetime.now().isoformat()
        self.save_baseline(baseline)
        return self.findings

if __name__ == "__main__":
    import sys
    target = sys.argv[1] if len(sys.argv) > 1 else "."
    monitor = SupplyChainMonitor(target)
    findings = monitor.run_full_scan()
    print(json.dumps(findings, indent=2, ensure_ascii=False))