supply-chain-security

Supply Chain Security with Weave Tollere

When to use this skill

Use Tollere whenever you are about to:

1. Run npm install <package>, pnpm add <package>, or yarn add <package>
2. Run pip install <package> or uv add <package>
3. Run cargo add <package>
4. Run docker pull <image> or use a Docker image in a Dockerfile/compose
5. Recommend a VS Code, Cursor, Windsurf, JetBrains, or Open VSX extension
6. Suggest a dependency, image, or extension to a user
7. Edit a package.json, requirements.txt, pyproject.toml, Cargo.toml, Dockerfile, or .vscode/extensions.json
8. Audit an existing project's dependencies or container images

Do not skip this step. Names you remember from training data may now be typosquats, deprecated, or compromised. The supply chain changes daily. Recent attacks (Axios March 2026, Checkmarx April 2026) prove that even popular, trusted projects get compromised.

Core tools

Package scanning

tollere_scan_package

Check a single package before installing.

{ "name": "axios", "version": "1.7.2", "ecosystem": "npm" }

tollere_scan_dependencies

Scan an entire package.json at once.

tollere_check_typosquat

Quick check for whether a name is suspiciously close to a popular package.

tollere_check_maintainer

Get a 0-100 reputation score for a package's maintainers.

tollere_check_cves

Query OSV.dev for known vulnerabilities.

tollere_diff_versions

Compare two versions to detect suspicious changes. The Axios case detector.

🆕 v0.2 tools

tollere_detect_sandwich

Detect sandwich-pattern attacks across version history. The Checkmarx case detector. Use when:

• A package has a recent suspicious history
• You're auditing a critical dependency
• The package was recently in the news for a compromise

{ "name": "some-package", "last_n": 20 }

The pattern: malicious code in version N → removed in N+1 (clean sandwich filling) → reappears in N+2. Designed to evade "always use latest" defenses.