Add stillrunning supply chain security rules #356
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| --- | ||
| description: Block malicious pip/npm packages before Cursor installs them | ||
| globs: ["**/*"] | ||
| alwaysApply: true | ||
| --- | ||
|
|
||
| # Supply Chain Security | ||
|
|
||
| Before installing any Python or npm package, check it against the stillrunning threat database: | ||
|
|
||
| ```bash | ||
| curl -s "https://stillrunning.io/api/check-package?name={package_name}" | jq .verdict | ||
| ``` | ||
|
|
||
| ## Rules | ||
|
|
||
| 1. If verdict is `DANGEROUS`: **DO NOT install**. Inform the user the package is blocked. | ||
| 2. If verdict is `SUSPICIOUS`: Warn the user and ask for confirmation before proceeding. | ||
| 3. If verdict is `CLEAN`: Proceed with installation. | ||
|
Comment on lines
+9
to
+19
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
check() {
local name="$1" ecosystem="$2" version="$3"
local response
response="$(
curl --fail --silent --show-error --max-time 10 --get \
--data-urlencode "name=${name}" \
--data-urlencode "ecosystem=${ecosystem}" \
--data-urlencode "version=${version}" \
"https://stillrunning.io/api/check-package"
)"
jq -e 'type == "object" and (has("verdict") or has("status"))' <<<"$response"
jq '{package, version, ecosystem, status, verdict}' <<<"$response"
}
check requests pip 2.31.0
check event-stream npm latest
check stillrunning pip "${STILLRUNNING_VERSION:?set STILLRUNNING_VERSION}"Repository: PatrickJS/awesome-cursorrules Length of output: 483 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- target file ---'
cat -n rules/stillrunning-supply-chain-security.mdc
printf '%s\n' '--- repository references ---'
rg -n -i 'stillrunning|check-package|DANGEROUS|BLOCKED|SUSPICIOUS|PENDING|UNKNOWN' . \
-g '!node_modules' -g '!dist' -g '!build' || trueRepository: PatrickJS/awesome-cursorrules Length of output: 10977 🌐 Web query:
💡 Result: Stillrunning.io is a supply chain security platform that intercepts package manager commands (such as pip, npm, uv, poetry, etc.) to perform security scans before installation [1][2][3]. When using the Citations:
🏁 Script executed: #!/usr/bin/env bash
set -u
for url in \
'https://stillrunning.io/docs' \
'https://stillrunning.io/api/check-package?name=requests' \
'https://stillrunning.io/api/check-package?name=requests&ecosystem=pip&version=2.31.0' \
'https://stillrunning.io/api/check-package?name=event-stream&ecosystem=npm&version=latest'
do
printf '\n--- %s ---\n' "$url"
curl --silent --show-error --location --max-time 15 \
--dump-header /tmp/stillrunning-headers \
--output /tmp/stillrunning-body \
"$url"
rc=$?
printf 'curl_exit=%s\n' "$rc"
sed -n '1,20p' /tmp/stillrunning-headers
printf '%s\n' 'body:'
head -c 4000 /tmp/stillrunning-body
printf '\n'
doneRepository: PatrickJS/awesome-cursorrules Length of output: 7875 🌐 Web query:
💡 Result: No indexed results were found for:
🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
curl --fail --silent --show-error --max-time 15 \
'https://stillrunning.io/docs' > /tmp/stillrunning-docs.html
python3 - <<'PY'
from html.parser import HTMLParser
class Text(HTMLParser):
def __init__(self):
super().__init__()
self.parts = []
def handle_data(self, data):
value = " ".join(data.split())
if value:
self.parts.append(value)
p = Text()
with open("/tmp/stillrunning-docs.html", encoding="utf-8") as f:
p.feed(f.read())
terms = ("check-package", "ecosystem", "version", "pending", "blocked",
"dangerous", "suspicious", "clean", "rate", "limit", "202")
lines = p.parts
for i, line in enumerate(lines):
if any(term in line.lower() for term in terms):
print("\n".join(lines[max(0, i-2):min(len(lines), i+4)]))
print("---")
PYRepository: PatrickJS/awesome-cursorrules Length of output: 9136 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
for query in \
'name=event-stream' \
'name=event-stream&ecosystem=npm' \
'name=event-stream&ecosystem=npm&version=3.3.6'
do
printf '\n--- ?%s ---\n' "$query"
curl --fail --silent --show-error --max-time 10 \
"https://stillrunning.io/api/check-package?${query}" \
| jq '{package, version, ecosystem, status, verdict, cached, message}'
doneRepository: PatrickJS/awesome-cursorrules Length of output: 493 Make the package check explicit and fail closed. Send Accept only a matching 🤖 Prompt for AI Agents |
||
|
|
||
| ## Examples | ||
|
|
||
| - `pip install requests` → Check `requests` → CLEAN → proceed | ||
| - `pip install malicious-pkg` → Check `malicious-pkg` → DANGEROUS → block and explain | ||
| - `npm install event-stream` → Check `event-stream` → SUSPICIOUS → warn user | ||
|
|
||
| ## For guaranteed blocking | ||
|
|
||
| Install the import hook (blocks at Python runtime, not just Cursor): | ||
|
|
||
| ```bash | ||
| pip install stillrunning | ||
| stillrunning --install-hook | ||
|
Comment on lines
+27
to
+33
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- candidate files ---'
git ls-files | rg '(^|/)(stillrunning|supply-chain-security|rules)(/|\.|$)' || true
printf '%s\n' '--- target file outline ---'
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline rules/stillrunning-supply-chain-security.mdc || true
fi
printf '%s\n' '--- target file ---'
wc -l rules/stillrunning-supply-chain-security.mdc
cat -n rules/stillrunning-supply-chain-security.mdc
printf '%s\n' '--- stillrunning references ---'
rg -n -i -C 3 'stillrunning|check-package|BLOCKED|pending|ecosystem' . --glob '!node_modules' --glob '!dist' --glob '!build' || trueRepository: PatrickJS/awesome-cursorrules Length of output: 41732 🌐 Web query:
💡 Result: The official repository for stillrunning is johhnyg/stillrunning [1]. Installation is documented via the command pip install stillrunning [1]. For general system setup, the site provides a shell-based installer (curl -sSL https://stillrunning.io/install | python3 - --token YOUR_TOKEN) [2], while the agent-setup documentation (stillrunning.io/agent-setup) guides integration with AI coding agents like Claude Code, Cursor, Devin, and Aider [3][4]. The project does not explicitly document an /api/check-package endpoint in its primary repository or PyPI metadata [1][5][6]. The query term /api/check-package is often associated with other developer tooling, such as the Zephex check-package tool [7], or R-based package checklist utilities [8], rather than the stillrunning security agent. Regarding package ecosystems, version parameters, and specific verdict values (e.g., pending, BLOCKED): - The tool is designed to protect Python-based environments (requires Python 3.8+) [1][5]. - While the documentation mentions features like scanning packages, adding to whitelists, and autonomous CI/CD modes [1], there is no public API documentation explicitly defining a /api/check-package verdict schema including 'pending' or 'BLOCKED' status values. - There is no evidence in the official stillrunning documentation confirming that it implements mandatory exact-version pinning or artifact/hash verification as a core documented feature [1][2]. Top results: [1][2][3][7] Citations:
🏁 Script executed: #!/bin/bash
set -eu
fetch() {
url="$1"
printf '\n--- %s ---\n' "$url"
curl --fail --location --silent --show-error --max-time 15 \
-H 'Accept: application/vnd.github+json' "$url" | sed -n '1,240p'
}
fetch https://api.github.com/repos/johhnyg/stillrunning
fetch https://api.github.com/repos/johhnyg/stillrunning/contents
fetch https://raw.githubusercontent.com/johhnyg/stillrunning/main/README.md
fetch https://raw.githubusercontent.com/johhnyg/stillrunning/master/README.md
fetch https://pypi.org/pypi/stillrunning/json
printf '\n--- agent setup headers/body ---\n'
curl --location --silent --show-error --max-time 15 -D - \
https://stillrunning.io/agent-setup | sed -n '1,240p'
printf '\n--- check-package response ---\n'
curl --location --silent --show-error --max-time 15 \
-w '\nHTTP_STATUS=%{http_code}\nCONTENT_TYPE=%{content_type}\n' \
'https://stillrunning.io/api/check-package?name=requests' | sed -n '1,120p'Repository: PatrickJS/awesome-cursorrules Length of output: 50388 🏁 Script executed: #!/bin/bash
set -eu
raw() {
url="$1"
printf '\n--- %s ---\n' "$url"
curl --fail --location --silent --show-error --max-time 15 "$url"
}
printf '%s\n' '--- endpoint probes ---'
for query in \
'name=requests' \
'name=requests&ecosystem=pypi&version=2.32.0' \
'name=event-stream&ecosystem=npm&version=4.0.1'
do
printf '\nQUERY=%s\n' "$query"
curl --location --silent --show-error --max-time 15 \
-w '\nHTTP_STATUS=%{http_code}\nCONTENT_TYPE=%{content_type}\n' \
"https://stillrunning.io/api/check-package?$query" | head -c 4000
printf '\n'
done
printf '%s\n' '--- official repository tree paths ---'
curl --fail --location --silent --show-error --max-time 15 \
'https://api.github.com/repos/johhnyg/stillrunning/git/trees/main?recursive=1' |
jq -r '.tree[] | select(.type=="blob") | .path' |
rg -i '(^|/)(readme|pyproject|setup|config|hook|scan|cli|api|agent|package|install|verdict|block)' |
head -200
for path in pyproject.toml stillrunning.yaml.example stillrunning/__init__.py; do
raw "https://raw.githubusercontent.com/johhnyg/stillrunning/main/$path" | \
rg -n -i -C 3 'version|install|hook|scan|npm|pypi|verdict|block|api|endpoint|hash' || true
done
printf '%s\n' '--- concise PyPI release metadata ---'
curl --fail --location --silent --show-error --max-time 15 \
https://pypi.org/pypi/stillrunning/json |
jq -r '
"version=\(.info.version)",
(.releases[.info.version][] |
"\(.filename) sha256=\(.digests.sha256) yanked=\(.yanked) url=\(.url)")
'Repository: PatrickJS/awesome-cursorrules Length of output: 7424 Make the bootstrap installation fail closed.
🤖 Prompt for AI Agents |
||
| ``` | ||
|
|
||
| More info: https://stillrunning.io/agent-setup | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: PatrickJS/awesome-cursorrules
Length of output: 14163
🌐 Web query:
site:stillrunning.io/docs stillrunning threat rules threats blocked 225k💡 Result:
The stillrunning homepage currently shows 224,540 threats blocked live—approximately 225k. It also states that live threat rules are updated hourly and packages are checked against its threat database before installation. (stillrunning.io)
Citations:
Remove the hard-coded threat count.
The stillrunning.io blocklist is dynamic and currently reports 224,540 rules. Replace the count with: “Checks packages against the stillrunning.io threat database.”
🤖 Prompt for AI Agents