https://github.com/aflock-ai/supply-chain-attacks

Catalog of real-world software supply-chain attacks reproduced as safe harnesses, each with cilock detection demonstrated by live CI. Trivy tag-rewrite, LiteLLM .pth stealer, Nx VS Code, actions-cool hijack, Shai-Hulud npm worm, Microsoft durabletask PyPI, GitHub source disclosure.

actions-cool attack-detection attestation cve-reproduction devsecops durabletask in-toto nx-attack opa-policy secretscan shai-hulud sigstore slsa supply-chain-attack supply-chain-security

Last synced: 22 Jun 2026