Issues

• Go toolchain pin 1.26.5 lacks the eMudhra intermediate blocklist (GO-2026-6809, fixed in 1.26.10)

  noeljackson/supplychain#85 · Filter by author noeljackson opened on Oct 22, 2026

• Homebrew tap stuck at v0.1.4: the tap's integrity ruleset refuses the release's cask push (409)

  noeljackson/supplychain#82 · Filter by author noeljackson opened on Oct 22, 2026
  1

• OSV silently reports not_applicable when an enclosing repository's .gitignore hides the target's lockfiles

  noeljackson/supplychain#81 · Filter by author noeljackson opened on Oct 22, 2026

• Dockerfiles and Containerfiles are not scanned for package IOCs or unpinned base images, at any depth

  noeljackson/supplychain#79 · Filter by author noeljackson opened on Oct 22, 2026
  1

• Interactive TUI mode (supplychain ui) using bubbletea

  noeljackson/supplychain#12 · Filter by author noeljackson opened on May 13, 2026

• Migrate OSV layer from osv-scanner shell-out to osv-scalibr library

  noeljackson/supplychain#11 · Filter by author noeljackson opened on May 13, 2026
  1

• Verify Sigstore signatures and SLSA provenance attestations

  noeljackson/supplychain#10 · Filter by author noeljackson opened on May 13, 2026

• Dependency-confusion check for private/internal package names

  noeljackson/supplychain#8 · Filter by author noeljackson opened on May 13, 2026

• Pull GHSA MAL-* malware advisories alongside CVEs

  noeljackson/supplychain#4 · Filter by author noeljackson opened on May 13, 2026

• Ingest OpenSSF Package Analysis dataset

  noeljackson/supplychain#3 · Filter by author noeljackson opened on May 13, 2026

• Integrate socket.dev API for real-time malicious-package signal

  noeljackson/supplychain#2 · Filter by author noeljackson opened on May 13, 2026