Supply chain

A hijacked package has no CVE yet. grayhat reads the dependency code itself and diffs what it's capable of.

CVE feeds only know about compromises after someone reports them. A package published an hour ago by a freshly hijacked maintainer won’t be in any of them. grayhat analyzes the code of each dependency version instead, once per version, and every team on grayhat is protected as soon as that version is analyzed.

Capability diffs

When a pull request changes a lockfile, grayhat compares what each updated package can do before and after:

left-pad-utils  2.4.1 → 2.4.2   patch release

capability        2.4.1    2.4.2
network           ·        + fetch(atob("aHR0cHM6Ly9…"))
env / secrets     ·        + process.env.*
process           ·        + postinstall: node ./x.js
filesystem        read     read

✕ blocked  new maintainer 3 days ago · obfuscated · no source tag

A patch release of a padding library has no reason to start reading environment variables and calling out to an obfuscated URL. That combination is flagged as critical before the lockfile change merges.

Signals it weighs

• New capabilities: network, environment and secrets, child processes, filesystem writes
• Install-time hooks such as postinstall
• Obfuscation: encoded strings, eval of decoded data, minified code in a source package
• Maintainer changes and releases with no matching source tag
• Names one typo away from a popular package