Supply Chain Bouncer

Supply Chain Bouncer helps developers check new or updated software libraries before allowing them into a project. These libraries, called dependencies, can save development time, but they may also introduce suspicious code or security risks. The project compares the old and new dependency lists, collects package information, and examines the code without running it. It looks for warning signs such as installation scripts, attempts to read credentials, network connections, and questionable package origins. IBM Bob helps explain what those warning signs mean. It coordinates three specialized investigators: Typosquat Detective: Checks whether a package name resembles a popular library and could mislead developers. Provenance Auditor: Reviews where the package comes from and what evidence supports its authenticity. Behavior Analyst: Examines suspicious code patterns and installation behavior. Their findings include evidence references and explain what remains uncertain. This gives the developer a review they can understand rather than just a warning label. The developer then chooses ALLOW, QUARANTINE, or BLOCK and provides a reason. A local gate checks that the decision still matches the reviewed files. Missing approvals, changed inputs, incomplete evidence, and hard policy violations prevent the next step from proceeding. The current prototype includes evidence reports, an interactive review menu, and a tested local gate. Its suspicious-package demonstration uses a synthetic fixture. Approvals currently assume a trusted local user; cryptographic signing and remote enforcement are future extensions.