Sigil Security Bot installs statistics

Sigil automatically scans new dependencies in your pull requests for supply chain threats before you merge. When a PR adds packages to package.json, requirements.txt, or pyproject.toml, Sigil analyzes them across six security phases: install hooks, dangerous code patterns, network exfiltration, credential access, obfuscation, and provenance. Results post directly as a PR comment with risk scores, severity ratings, and explanations — giving your team visibility into every new dependency.

Sigil Security Bot

Automatically scan new dependencies introduced in pull requests for

malicious patterns, supply chain risks, and security threats.

How it works

• Open a PR that adds a dependency (package.json, requirements.txt, pyproject.toml) • Sigil detects new packages and checks them against its threat database • A comment appears on the PR with a risk verdict and findings

What it detects

• Install hooks — setup.py cmdclass, npm postinstall scripts • Dangerous code — eval(), exec(), pickle, child_process • Network exfiltration — outbound HTTP to unknown hosts, webhooks, DNS tunneling • Credential access — ENV variable harvesting, SSH key access, API key extraction • Obfuscation — base64 encoding, charCode manipulation, hex-encoded payloads • Provenance — git history anomalies, hidden files, suspicious binaries

Verdict levels

• ✅ LOW_RISK — No significant findings • ⚠️ MEDIUM_RISK — Some patterns worth reviewing • ❌ HIGH_RISK — Likely malicious or dangerous patterns • 🚨 CRITICAL_RISK — Strong indicators of malicious intent

Permissions required

• Pull requests: Read & Write (to post scan comments) • Contents: Read-only (to read PR diffs) • Metadata: Read-only (automatic)

Description from the GitHub Marketplace listing.