An SBOM Proves What You Installed. It Can't Prove You Should Have.

An SBOM is a receipt. It tells you what you installed. It does not tell you if you were right to install it.

Most teams use an SBOM and CVE scans in their CI/CD pipelines. These tools are great for finding known vulnerabilities in existing packages. But they have a massive blind spot when using AI coding agents.

An AI agent proposes a package name. It does this with the same confidence whether the name is real, a hallucination, or a typosquat.

If an attacker registers a malicious package name yesterday, it has no CVE yet. Your post-install scan will see it and mark it as clean. The scan is honest, but it answered the wrong question. It answered "is this known to be bad?" instead of "should this name exist in our stack?"

By the time an SBOM records a malicious package, the damage is done. Malicious code often runs during the install phase via postinstall scripts. It can steal your environment variables and CI secrets before your scanner even sees the file tree.

You need a verdict before the side effect.

I built a simple tool to solve this. It is a pre-install provenance gate. It works differently than a scanner:

• It checks names BEFORE npm install runs. • It uses a default-deny approach against a vouched baseline. • It flags typosquats by measuring edit distance from popular packages. • It catches hallucinations that do not match any known good names. • It verifies your .npmrc to ensure you are not hitting a rogue registry.

This tool is offline, keyless, and uses only the Python standard library. It does not connect to the network. It does not resolve packages. It simply looks at the proposed names and asks: "Do we vouch for this name?"

If the name is not in your vouched snapshot and not in a popular baseline, the gate returns DENY.

Stop relying only on records of what happened. Start deciding what is allowed to happen.

Source: https://dev.to/alex_spinov/an-sbom-proves-what-you-installed-it-cant-prove-you-should-have-117c

Optional learning community: https://t.me/GyaanSetuAi