Use case · supply-chain defense
Stop the worm at publish, not at install.
SynOI Supply Chain Guard is in active development; public beta Q1 2027. Mini Shai-Hulud spread through compromised npm publish tokens. Supply Chain Guard wraps `npm publish` so every release requires out-of-band human approval before any consumer-side scanner ever sees a malicious version.
What this covers
Publisher-side human-in-the-loop approval is a distinct layer from consumer-side scanning. Both should exist; neither is the other. Supply Chain Guard is in active development, public beta Q1 2027.
- Supply Chain Guard · publisher-side HITL on `npm publish` and equivalents
- Registry Mirror · npm-compatible mirror with state-divergence detection on install
- PR Bot · GitHub App comments on package-lock changes with divergence verdicts
- OID Resolver · public content-addressed attestation surface
- in-toto attestations · consumable by any SLSA-aware verifier