internal/

Package analyzer orchestrates concurrent package analysis: a bounded worker pool fans out over the dependency list, each worker fetches the artifact from its registry and runs every heuristic, and results stream back over a channel as they complete.

Package baseline implements accepted-findings files (.sandtrap.json).

Package cli implements the sandtrap command line interface using only the standard library — a supply chain security tool should have no supply chain of its own.

Package heuristics contains the detection rules Sandtrap runs against a package artifact.

Package lockfile discovers and parses dependency manifests into the flat package list the analyzer consumes.

Package registry fetches package metadata and archives from npm and PyPI.

Package report renders scan results for humans (colored terminal) and machines (JSON), and decides the process exit code for CI gating.

Package runlog provides the execution log: a timestamped, append-style record of everything a run did (configuration, every package analyzed, every finding, errors, final summary).