FOREFRONT

All repositoriesMSFT / Software supply chain

Release Desk.

Inspect a package manifest before a community deploys it. Identify broad version ranges, Git dependencies and install lifecycle hooks, then export a reproducible review.

Deploy project Run technology Download repository

INSIDE THE REPOSITORY

A complete place to start.

  • Manifest dependency inventory
  • Version pinning review
  • Install lifecycle visibility
  • Exact token contract and pair inspection
  • Bounded ERC-20 transfer activity explorer
  • Local community funding scenario planner
  • Evidence export with SHA-256 verification
  • Nine automated checks and GitHub CI
  • MIT license, method, architecture and API docs
Node.js 22No runtime dependenciesVercel ready

Run locally

npm test
npm start

Open localhost:3000. The technology runs with no API key. Live chain and DNS reads use public providers.

Deploy in your account

Extract the archive and upload its contents to a GitHub repository you control. Import that repository into Vercel, or run npx vercel --prod in the extracted folder. The included configuration sets the output directory and tests.

Return to the Deploy studio to publish your project, token pair and repository on the public build board.

29 SOURCE FILES / V1.0.0

Inspect everything.

.env.example.github/workflows/check.yml.gitignoreLICENSEREADME.mdSECURITY.mdapi/activity.mjsapi/dns.mjsapi/health.mjsapi/token.mjsdev.mjsdocs/API.mddocs/ARCHITECTURE.mddocs/METHOD.mdexamples/inputs.jsonpackage.jsonpublic/app.mjspublic/config.mjspublic/core/engine.mjspublic/core/math.mjspublic/favicon.svgpublic/index.htmlpublic/styles.cssserver/api.mjsserver/handler.mjstests/api.test.mjstests/engine.test.mjstools/verify-evidence.mjsvercel.json

This download contains only this standalone project. It includes no account credentials.

METHOD

What it calculates.

Classify manifest dependency specifications and enumerate install lifecycle script names. Static inspection never executes scripts or downloads packages.

LIMITS

What the evidence means.

This is not a vulnerability scanner, malware detector or software attestation. A pinned version can still be vulnerable.

The funding planner does not transfer tokens or route rewards. Deploying this repository does not imply company endorsement or investment value.

Inputs you control.

InputTypeUnits
package.jsonEditable data—