Use case · supply-chain defense
Stop the worm at publish, not at install.
SynOI Supply Chain Guard is in active development; public beta Q1 2027. Mini Shai-Hulud spread through compromised npm publish tokens. Supply Chain Guard wraps `npm publish` so every release requires out-of-band human approval before any consumer-side scanner ever sees a malicious version.
Coming soon
Supply Chain Guard is in active development; public beta Q1 2027. Today: publisher-side human-in-the-loop (HITL) approval is a distinct layer from consumer-side scanning. Both should exist. Neither is the other.
- Supply Chain Guard · publisher-side HITL on `npm publish` and equivalents
- Registry Mirror · npm-compatible mirror with state-divergence detection on install
- PR Bot · GitHub App comments on package-lock changes with divergence verdicts
- OID Resolver · public content-addressed attestation surface
- in-toto attestations · consumable by any SLSA-aware verifier