Six rule families plus up to 12 supply-chain attack signals. One evaluation per install.

Flags packages whose lifecycle hooks — preinstall/postinstall in npm, setup.py extensions in pip, build.rs in Cargo, Composer hooks — run remote fetches or decode base64 payloads. Refuses the install before the hook fires.

Quarantines any version published inside your cooldown window — a few hours to a few days — on the install path, so a poisoned release sits unreachable while the ecosystem, the malware feeds, and the publisher-anomaly signals catch up. Package age asks how old the package is; cooldown asks how old this version is, which is the question the Axios, Chalk, and Mastra takeovers turned on: a brand-new release of a long-trusted package. Runs on every registry that exposes a per-version publish date — the same coverage as the minimum-age rule. Absent date metadata fails open, never quarantining on a guess.

Compares the current maintainer set against the package's history. A surprise publisher on a popular dependency refuses on the install path pending review. The account-takeover class — a hijacked maintainer pushing a tainted version of a package you already trust — is the live threat right now, ahead of the typosquats that catch the easier, older mistakes. Works on npm, PyPI, RubyGems, NuGet, and Maven.

Catches semver regressions, multi-major skips, and backdated publish timestamps used to sneak a compromised version under a higher constraint. Narrow by kind: semver_regression, major_skip, timestamp_regression.

Refuses packages whose published source includes zero-width, bidi-override, or Unicode-tag characters. Closes the GlassWorm and Trojan Source attack class without running any code. Bounded at 500 files and 50 MiB per artifact.

A rolling 24-hour counter per publisher. When one compromised account starts pushing dozens of tainted versions in a day, the burst trips the rule before your build runs. Threshold is tunable.

Dependency confusion works because attackers publish your internal package names on public registries first. Reserved-namespace packs block the attack class up front. One-click apply of curated starters per ecosystem.

Blocks the install when the requested name is a near-miss of a popular package. BK-tree, homoglyph, and word-reorder matchers run against curated seed lists. Fifteen ecosystems including Go, CocoaPods, and GitHub Actions. Dart/pub gets CVE and typosquat coverage only — no malicious-package prevention.

A Docker-native malware index matched by digest and by name-plus-tag. Closes the container-image gap that public SCA feeds miss. Lookup is constant-time; a hit drops the trust score to -100.

Walks every image layer with Trivy under the hood. Vulnerabilities hidden beneath a clean top-level manifest are blocked at install; a clean tag no longer guarantees a clean image.

InRelease verification for APT, repomd.xml.asc for Yum/DNF. A mirror that tampers with a package between publish and fetch fails the chain. Debian and Fedora keyrings ship embedded.

Native CVE detectors for Alpine, Debian, Red Hat, and Oracle Linux — distinct from upstream OSV, with each distro stream on its own update cadence. A vendor advisory becomes a block-list entry the same hour the distro publishes it.

Bundled HF-native coordinate-match feed shipped in-process. Closes the gap where public SCA indexes lag on model-repo malware. Lookup is constant-time at resolve.

Unmaintained repos with an active npm publisher are a compromise waiting to happen. Each package gets a composite trust score folding in repo activity, ownership match, license, age, version count, and checksum presence. Set the floor you're comfortable with.

Every upstream fetch is audited against the declared hash. Pick log, quarantine, or block mode per ecosystem. Distinguishes a real mismatch from an upstream that never published a hash.