mod-audit
An open-source supply chain security auditing tool for Claude Code Mods. It runs offline using only the standard library, focuses on detecting malicious changes in extension updates through incremental risk reports, and provides baseline snapshot and diff comparison functionality.
Timeline (last 90 days)
mod-audit is an offline, standard-library-only supply chain auditor for Claude Code Mods.
mod-audit v0.2 focuses on update-path defenses that are overlooked by installation-time scanning.
mod-audit v0.2 adds two new commands: mod-audit baseline and mod-audit diff.
The baseline command takes a hash snapshot of installed Mods and records their hooks and permissions.
The diff command re-audits only the changed portions (delta) and outputs a grouped report.
mod-audit v0.2 focuses on four categories of incremental signals: newly added network exfiltration, credential path reads, new or replaced hooks, and permission widening.
The DIFF-PERM-WIDENED rule triggers a high-risk alert when an update upgrades shell: false to true or adds network authorization.
mod-audit is a local, offline command-line tool; data does not leave the local machine and verdicts are returned in milliseconds.
mod-audit is a detection tool based on offline heuristic rules, not a sandbox.
mod-audit uses regex-based TypeScript scanning and maintains zero dependencies, but still requires manual review when confronted with heavily obfuscated code.
2 more timeline events
All Facts (12)
The trustworthiness of a diff depends entirely on the baseline; snapshots must be generated from a clean installation and stored in a location that the update program cannot tamper with.
50%Unverifiedmod-audit v0.2 focuses on update-path defenses that are overlooked by installation-time scanning.
50%Unverifiedmod-audit is an offline, standard-library-only supply chain auditor for Claude Code Mods.
50%UnverifiedThe baseline command takes a hash snapshot of installed Mods and records their hooks and permissions.
50%UnverifiedThe diff command re-audits only the changed portions (delta) and outputs a grouped report.
50%Unverifiedmod-audit v0.2 focuses on four categories of incremental signals: newly added network exfiltration, credential path reads, new or replaced hooks, and permission widening.
50%UnverifiedThe DIFF-PERM-WIDENED rule triggers a high-risk alert when an update upgrades shell: false to true or adds network authorization.
50%Unverifiedmod-audit is a local, offline command-line tool; data does not leave the local machine and verdicts are returned in milliseconds.
50%Unverifiedmod-audit is a detection tool based on offline heuristic rules, not a sandbox.
50%Unverifiedmod-audit uses regex-based TypeScript scanning and maintains zero dependencies, but still requires manual review when confronted with heavily obfuscated code.
50%Unverifiedmod-audit uses the MIT license, has zero dependencies, supports Python 3.9+, and can be installed via pip install mod-audit.
50%Unverifiedmod-audit v0.2 adds two new commands: mod-audit baseline and mod-audit diff.
50%