Runtime dependency-behavior monitor for Node.js. Two engines: in-process telemetry + an out-of-process (strace) trust boundary that sees native egress & persistence. Defense-in-depth for npm supply-chain attacks — SARIF, GitHub Action, zero deps.
nodejs npm security supply-chain owasp ci-cd postinstall sarif devsecops threat-intelligence dependency-monitoring malware-detection runtime-monitoring credential-theft npm-audit github-actions zero-dependencies supply-chain-security backdoor-detection wall-of-shame
-
Updated
Aug 4, 2026 - JavaScript