Supply chain integrity

# Check a PyPI package for supply chain compromise
curl "https://api.attestd.io/v1/check?product=litellm&version=1.82.7" \
  -H "Authorization: Bearer YOUR_API_KEY"

# Check an npm package for supply chain compromise
# Scoped package names must be URL-encoded (@scope/name -> %40scope%2Fname)
curl "https://api.attestd.io/v1/check?product=%40bitwarden%2Fcli&version=2026.4.0" \
  -H "Authorization: Bearer YOUR_API_KEY"

import attestd

client = attestd.Client(api_key="YOUR_API_KEY")

# Check a PyPI package (safe version)
result = client.check("langchain", "0.3.0")

# Check supply chain signal
if result.supply_chain and result.supply_chain.compromised:
    print(f"[ALERT] Malicious version detected: {result.product} {result.version}")
    print(f"Detected by: {', '.join(result.supply_chain.sources)}")
    print(f"Description: {result.supply_chain.description}")
    raise SystemExit("Do not deploy - compromised dependency")

if result.supply_chain is None:
    print(f"Note: {result.product} is not in supply chain monitoring")
    # Still check CVE risk
    if result.risk_state in ("critical", "high"):
        raise SystemExit(f"CVE risk detected: {result.risk_state}")

print(f"Safe to proceed: {result.product} {result.version}")

import { Client } from '@attestd/sdk';

const client = new Client({ apiKey: process.env.ATTESTD_API_KEY });

// Check an npm package
const result = await client.check('@bitwarden/cli', '2026.4.0');

if (result.supplyChain?.compromised) {
  console.error('SUPPLY CHAIN ALERT:', result.supplyChain.description);
  process.exit(1);
}

console.log(`Safe to proceed: ${result.product} ${result.version}`);

# requirements-check.py
import attestd
import re
import sys

def parse_requirements(filename):
    """Parse requirements.txt and return list of (package, version) tuples"""
    packages = []
    with open(filename) as f:
        for line in f:
            line = line.strip()
            if not line or line.startswith('#'):
                continue
            # Handle == and >= operators
            if '==' in line:
                pkg, ver = line.split('==')
                packages.append((pkg.strip(), ver.strip()))
            elif '>=' in line:
                pkg, ver = line.split('>=')
                packages.append((pkg.strip(), ver.strip()))
    return packages

def check_dependencies(filename, api_key):
    """Check all dependencies for supply chain compromise"""
    client = attestd.Client(api_key=api_key)
    packages = parse_requirements(filename)
    
    compromised = []
    for package, version in packages:
        try:
            result = client.check(package, version)
            
            # Check supply chain compromise
            if result.supply_chain and result.supply_chain.compromised:
                compromised.append({
                    'package': package,
                    'version': version,
                    'reason': result.supply_chain.description,
                    'sources': result.supply_chain.sources
                })
            
            # Also check CVE risk
            if result.risk_state in ("critical", "high"):
                compromised.append({
                    'package': package,
                    'version': version,
                    'reason': f"CVE risk: {result.risk_state}",
                    'cves': result.cve_ids
                })
        except attestd.AttestdUnsupportedProductError:
            # Not in attestd coverage - not necessarily bad, but alert
            print(f"[WARNING] {package} not in attestd coverage")
    
    if compromised:
        print("[ERROR] Compromised or risky packages found:")
        for item in compromised:
            print(f"  {item['package']}@{item['version']}: {item['reason']}")
        sys.exit(1)
    else:
        print(f"[OK] All {len(packages)} dependencies passed supply chain check")

python requirements-check.py requirements.txt