How elastic/supply-chain-monitor works
Supply Chain Monitor tracks releases among popular PyPI and npm packages, compares each new release with its predecessor, asks Cursor Agent to assess the diff, and can alert Slack on malicious findings. The main workflow is orchestrated in monitor.py; package_diff.py, analyze_diff.py, and slack.py provide the comparison, assessment, and alerting capabilities. README-described polling, watchlist, and persistence behavior is included; some wiring is documented rather than visible in the sampled excerpts.
Main entry points: monitor.py PyPI Polling · package_diff.py Package Differ · analyze_diff.py Diff Analyzer · pypi_monitor.py PyPI Event Viewer
Components 18
Monitoring
- Monitor Orchestrator
monitor.py - Polling State
monitor.py
Registry Monitoring
- PyPI Polling
monitor.py - npm Polling
monitor.py - Package Watchlists
monitor.py - PyPI Event Viewer
pypi_monitor.py - PyPI Top Packages
top_pypi_packages.py
Release Analysis
- Package Differ
package_diff.py - Unified Diff Report
package_diff.py - Diff Analyzer
analyze_diff.py
External Services
- Slack Client
slack.py - PyPI Registry
- npm Registry
- PyPI Rankings Dataset
- npm Download Dataset
- Cursor Agent CLI
- Slack API
Other components
- Operator
Connections 29
- Operator → Monitor Orchestrator: configures and starts
- Monitor Orchestrator → Package Watchlists: loads
- Package Watchlists → PyPI Rankings Dataset: fetches PyPI rankings
- Package Watchlists → npm Download Dataset: fetches npm rankings
- Monitor Orchestrator → PyPI Polling: starts polling
- Monitor Orchestrator → npm Polling: starts polling
- PyPI Polling → PyPI Registry: polls changelog
- npm Polling → npm Registry: fetches changes and metadata
- PyPI Polling → Package Watchlists: filters releases
- npm Polling → Package Watchlists: filters packages
- PyPI Polling → Package Differ: processes releases
- npm Polling → Package Differ: processes releases
- Package Differ → PyPI Registry: downloads PyPI versions
- Package Differ → npm Registry: downloads npm versions
- Package Differ → Unified Diff Report: writes report
- PyPI Polling → Diff Analyzer: requests assessment
- npm Polling → Diff Analyzer: requests assessment
- Diff Analyzer → Cursor Agent CLI: submits diff for analysis
- Diff Analyzer → PyPI Polling: returns verdict
- Diff Analyzer → npm Polling: returns verdict
- PyPI Polling → Slack Client: alerts on malicious verdict
- npm Polling → Slack Client: alerts on malicious verdict
- Slack Client → Slack API: posts alert
- Monitor Orchestrator → Polling State: reads and saves progress
- Operator → PyPI Event Viewer: runs standalone poller
- PyPI Event Viewer → PyPI Registry: polls changelog
- PyPI Event Viewer → PyPI Rankings Dataset: loads rankings
- Operator → PyPI Top Packages: runs listing tool
- PyPI Top Packages → PyPI Rankings Dataset: fetches rankings