Supply Chain Intelligence

What is supply chain intelligence?

Modern websites depend on dozens of third-party scripts - analytics platforms, chat widgets, payment processors, A/B testing tools, and more. Each of these is a potential supply chain risk: if a supplier is breached (or if a malicious package is injected into their CDN), your users are affected even though your own code is clean.

Shieldome's Supply Chain Intelligence feature operates in two modes:

• Per-scan detection - when you scan a URL, Shieldome parses every <script> and <link> tag in the page HTML and matches them against a curated supplier database of 100+ known third-party vendors.
• Supplier intelligence browser - a read-only directory of all known suppliers, their data access categories, historical incident records, and risk level - available without running a scan.

How per-scan detection works

1. Shieldome fetches your target URL and parses the HTML response
2. All src attributes on <script> tags and href attributes on <link> tags are extracted
3. Each external URL is matched against the supplier database by domain
4. Matched suppliers are tagged with their category, data access scope, and any known incidents
5. A supply chain risk score is calculated based on the number of suppliers, their categories, and incident history
6. Findings appear in the Supply Chain tab of your scan results

Supplier categories

Risk levels

Each supplier in the database is assigned a risk level based on historical incidents and data access scope:

Known compromised packages

Shieldome flags any use of packages that have been involved in confirmed supply chain attacks:

Subresource Integrity (SRI)

For every third-party script detected, Shieldome checks whether a integrity attribute is present on the <script> tag. SRI lets browsers verify that a fetched resource has not been tampered with by comparing its hash to the expected value you specify.

Missing SRI is reported as a separate finding. To generate an SRI hash for any external script:

curl -s https://cdn.example.com/lib.min.js | openssl dgst -sha384 -binary | openssl base64 -A

Then add the hash to your script tag:

<script src="https://cdn.example.com/lib.min.js"
        integrity="sha384-<hash>"
        crossorigin="anonymous"></script>

Exposed dependency manifests

As part of the supply chain scan, Shieldome also checks whether your dependency manifest files are publicly accessible. Exposed manifests let attackers enumerate your exact package versions and target known vulnerabilities.

Paths checked include:

• /package.json, /package-lock.json, /yarn.lock
• /composer.json, /Gemfile, /requirements.txt
• /go.sum, /Cargo.toml, /pom.xml
• /.env, /.env.production, /.npmrc

Using the supplier intelligence browser

Navigate to Supply Chain in the app's top navigation to browse the full supplier database without running a scan. Use the filter bar to:

• Search by supplier name or domain
• Filter by category (analytics, payment, session recording, etc.)
• Filter by risk level (Critical, High, Medium, Low)

Each supplier card shows the domain, data access items, incident history, and risk level. Use this before integrating any new third-party tool to assess its risk profile in advance.

Remediation guidance

When high-risk suppliers are detected in a scan:

1. Audit necessity - confirm whether the supplier integration is still needed; remove unused scripts
2. Add SRI - for scripts you keep, add integrity hashes and lock to a specific version
3. Review data access - ensure session-recording tools are configured to mask form fields and PII
4. Use a Tag Manager audit - if Google Tag Manager is present, audit what tags are loaded; GTM has full DOM access and can load arbitrary scripts
5. Subscribe to supplier advisories - follow supplier security mailing lists and update dependencies promptly after any compromise notification