Reachable dependency risk, malicious-package and typosquat detection, and a checksum-pinned agent.
Only the dependencies you actually use, that matter.
Typosquat and supply-chain package catches.
No curl|sh - the agent is checksum-verified.
Supply chain attacks doubled in 2025 and turned automated - self-replicating worms, malicious packages, compromised build steps. Scanning for known CVEs is no longer enough; the questions are which dependency you actually reach, and whether your own pipeline can be subverted.
Is the vulnerable or malicious package actually imported and reached? Noise drops accordingly.
Catch supply-chain and typosquat packages against OSV and live CVE feeds.
A checksum-pinned agent - no curl-pipe-shell bootstrap a compromised registry could replace underneath you.
A credential removed in the latest commit still lives in history; we scan both HEAD and historical blobs.
A curated CVE and threat-intel cache keeps detection current air-gapped, with no phone-home.
Every finding here deduplicates into one risk-weighted posture, correlates into attack-chains, and can block the build at a fail-closed CI gate.
From discovery to a proven attack chain. A PoC in your own environment.