SafePack
Separate enforceable policy from advisory analysis so supply-chain review remains explainable even when evidence is incomplete.
- Lifecycle scripts
- Workflow permissions
- Lockfile and artifact checks
- OSV records
- Provenance signals
- Reputation and review notes
Evidence informs the reviewer without silently overriding policy.
Context
Review before trust
Installing a dependency or adopting a workflow can execute code with developer or CI privileges. SafePack explores a review boundary before a normal install is allowed, while acknowledging that inspection cannot prove safety.
Decisions
Policy before generated judgment
The design keeps allow, warn, and block outcomes deterministic. Reputation, provenance, vulnerability records, and future generated summaries can inform a reviewer, but do not silently override policy.
System
A proposed review surface
The public prototype combines package analysis, lockfile scanning, signature and OSV checks, artifact comparison, workflow auditing, accepted-risk baselines, explicit exit codes, and multiple report formats.
Evidence
Repository evidence, not production proof
The repository contains source, fixtures, tests, and security documentation. This portfolio deliberately stops short of calling the prototype verified because an owner-run build and smoke-test suite have not yet been completed.
Result
Outcomes
- The repository describes a Phase 1 CLI for package, lockfile, artifact, OSV, and workflow review.
- The design keeps allow, warn, and block decisions deterministic while treating generated summaries as advisory.
- Threat-model and limitation documentation are part of the public prototype scope.
Boundaries
Known limitations
- The owner has not yet independently built and smoke-tested the repository for this portfolio review.
- The project does not prove that a reviewed package or workflow is safe.
- Reproducible-build verification and broader sandbox validation remain outside the current claim set.
Provenance
Evidence ledger
Public source
The repository contains the prototype source, fixtures, tests, threat model, and policy documentation described here.
Review sourceVerification boundary
Portfolio status remains Research Prototype until an owner-run build, unit suite, and benign/adversarial smoke test are completed.
Stack
Technologies
- TypeScript
- Node.js
- Docker
- OSV
- GitHub Actions