s1ngularity-check

Rust CLI that scans JavaScript/TypeScript project folders for dependencies impacted by the s1ngularity/nx supply-chain attack. The tool looks for package.json/package-lock.json manifests, reports packages that match the impacted list, and returns a non-zero exit code when issues are found.

Features

• Recursively discover project folders containing Node manifests while skipping node_modules.
• Detect impacted packages using a baked-in impacted-packages.json or a user-supplied list.
• Display findings per folder with highlighted sections and manifest sources.
• Exit with status 1 when any impacted dependency is detected, enabling CI gating.

Installation

Using Homebrew

brew tap beeltec/s1ngularity-check
brew install s1ngularity-check

Using Cargo

cargo install --git https://github.com/beeltec/s1ngularity-check.git

From Source

git clone https://github.com/beeltec/s1ngularity-check.git
cd s1ngularity-check
cargo build --release

The compiled binary will be available at target/release/s1ngularity-check.

Usage

s1ngularity-check [OPTIONS] <FOLDER>...

Scan one or more project folders. When --recursive is set, the command searches each directory tree for sub-folders that contain package.json or package-lock.json files.

Common Examples

• Scan a single project and fail the build on impacted dependencies:

  s1ngularity-check path/to/app
  

• Recursively scan a monorepo, using a custom JSON list of impacted packages:

  s1ngularity-check --recursive --impacted-dict impacted-packages.json apps/packages
  

Options

• -r, --recursive – include subdirectories that contain Node manifests.
• -d, --impacted-dict <FILE> – override the baked-in impacted list with your own JSON file.
• <FOLDER>... – one or more directories (comma separated) to inspect.

Impacted Package Data

By default, the binary embeds an impacted-packages.json snapshot sourced from known indicators for the attack. Provide --impacted-dict to supply your own JSON map ({ "package-name": ["version", ...] }). The most recent list bundled in the binary lives at the repository root.

Exit Codes

• 0 – no impacted dependencies detected.
• 1 – at least one impacted dependency was reported.
• 2 – an unexpected error occurred (I/O, JSON parsing, etc.).

Development

cargo fmt
cargo clippy --all-targets
cargo test

Fixtures used for testing and manual validation reside in the fixtures/ directory.

License

This project is available under the MIT license; see the LICENSE file for full terms.