Threat Intelligence
Know what is moving upstream before it reaches you. Named attack classes, live maintainer and registry signals, and the research feed the detectors are built from.
The upstream attack surface.
Mapped.
Depi builds a live graph across 10 node types, projects, manifests, packages, maintainers, registries, email domains, GitHub repos, CI pipelines, attack vectors, and organizations. Every trust relationship in your upstream security, continuously re-evaluated.
Upstream attacks don't start in your code.
Your real attack surface sits above the manifest.
They start in the pipeline that published your dependency. In the maintainer account taken over last Tuesday. In the build steps and registries your code never declares but always trusts. Depi maps all of it.
Your SCA
- Manifest declared deps
- Known vulnerability matches
- Pipeline tampering
- Maintainer trust
- GitHub Action cache poisoning
- Build steps not declared in the manifest
Depi
- Repos & manifests
- Direct + transitive packages
- Registries & ecosystems
- CI pipelines & actions
- Maintainers & email domains
- Build steps not declared in the manifest
How does Depi work?
No agents. No code changes. A GitHub App or a GitLab token, and Depi starts walking your upstream security, every package, every pipeline, every maintainer.
Connect
One click. GitHub or GitLab, live in minutes. Scanning is read-only. Fix PRs open only when you accept them, and you merge.
Map
Every link, mapped. Packages, pipelines, registries, and the people behind them. Your whole upstream, live.
Fix
Swipe. Match. Ship. Every finding comes with a patch ready to merge. Ten minutes a week.
10 node types.
Every edge a trust relationship.
Depi doesn't just enumerate packages. It walks every edge. The graph below is the real TanStack compromise of May 2026: a pull request reaches a pull_request_target workflow, the workflow leaks its cache credentials, the poisoned pnpm store is restored by the release pipeline, and 47+ packages ship backdoored with valid provenance. Depi mapped that chain 25 days before it was executed.
TanStack's own maintainers did nothing wrong. The compromise entered through a workflow trigger, which is why Depi treats pipelines as nodes and not as build detail.
A static SBOM tells you what shipped.
Depi tells you what could.
SBOM tools enumerate names. Depi maps causation.
Same packages, completely different posture.
| Capability | Static SBOMFOSSA · ANCHORE · SYFT · OSS REVIEW | Depi dynamic SBOM |
|---|---|---|
Lists package names + versions | Yes, that's the entire output | Yes, with maintainer + pipeline provenance |
Snapshot vs continuous | Snapshot at scan time. Stale within hours. | Continuously re-evaluated. Re-graphs on every push and every upstream change. |
Maps the upstream chain | No, the chain stops at the package | Yes, manifest → registry → repo → pipeline → maintainer → domain |
Detects pipeline tampering | Silent. Pipelines aren't in the model. | GitHub Action Cache Poisoning, PWN Request, Artifact Poisoning, Short SHA |
Detects maintainer compromise | Silent. Maintainers aren't in the model. | Email domain expiry, nameserver hijack, org takeover, leaked maintainer credentials |
Findings ranked by | CVSS, global, ecosystem-level | Exploitability + your blast radius. Per-project depth. |
Output | JSON / SPDX / CycloneDX file | Live graph + ranked findings + auto-generated fix PRs |
Three ways in.
One graph underneath.
The platform is one upstream graph. These are the three surfaces teams actually work from, each with its own page.
Fix Inbox
Every finding arrives as a candidate patch. Accept it, skip it, or ask for a different one. The ones you keep open their own PR and ship themselves.
Incident Response
When an advisory drops, the blast radius is already mapped to your tree. Which projects are exposed, how deep the path runs, and what remediation is queued.
The fix inbox.
A dating app for your patches.
For every finding, Depi generates a candidate patch and brings it to you. Swipe through them: it's a match, it's not, or ask for a different one. The ones you like open as PRs and ship themselves. Ten minutes a week, your queue stays clean.
PR directly in GitHub or GitLab. With CI green, you merge.
Merged
depi: pin rollup transitive to 4.21.3 · TOCTOU
8h
Pins rollup via overrides. The Rollup TOCTOU vulnerability (DEPI-2026-001) affects this build path through Vite. Public disclosure expected within 7 days.
Affected projects: checkout-svc, admin-portal
Blast radius:
Critical
"dependencies": {
"vite": "^5.4.0",
"rollup": "^4.21.0"
"rollup": "4.21.3"
},
"overrides": {
"rollup": "4.21.3"
}
Open
depi: restrict workflow permissions · PWN Request
8h
.github/workflows/release.yml uses pull_request_target with default token permissions. Mitigates Action PWN Request (DEPI-018).
Generated remediation · class: ACTION_PWN
Severity:
High
on:
pull_request_target:
types: [opened, synchronize]
permissions:
contents: read
pull-requests: read
Where Depi runs
Five package ecosystems and two source-control providers today. Coverage expands when researcher demand and customer demand line up.
npm
Dependency confusion. NPX confusion. Maintainer trust. Ecoisoning.
PyPI
Setup-time scripts. Wheel vs sdist drift. Maintainer trust.
Bundler
Ruby gems, gemfile.lock provenance, gemspec analysis.
Cargo
Rust crates, build.rs scripts, registry trust.
Maven
Java artifacts, pom.xml plugins, groupId namespace trust.
Actions
GitHub Actions workflow analysis, 14 attack classes covered.
GitHub · App
Install on the whole org or picked repos. Scanning only reads. A fix PR opens only when you accept one, and Depi never merges it.
GitLab · Token
gitlab.com or self-managed, with a service account token. Scanning only reads. Fix merge requests need write access, which you grant separately.
The classes your scanner
is silent on.
Some named by us, some by the wider community, some still unnamed. New classes ship as we find them. Here's a slice.
PACKAGE REGISTRY · 6 of 14
- Dependency ConfusionPrivate package name shadowed by an identically-named package in a public registry. Build resolves the public one.
- NPX Confusionnpx resolves from the public registry at run time. Bypasses lockfiles entirely. Never appears in any installed-package list.
- Package Name ConfusionTyposquats and homoglyphs targeting your developers. react-dom vs reactdom.
- Package TakeoverAbandoned package, claimed maintainer, malicious patch shipped. Lockfile pulls it on the next bump.
ACCOUNT & IDENTITY · 4 of 7
- Email Domain TakeoverExpired maintainer email domain. Account claimable for $10. We did this 54.8M times in November 2024.
- Organisation TakeoverAbandoned GitHub org name claimed and re-used to publish under a familiar handle. The blue check that wasn't.
- Workspace ConfusionPrivate org name shadowed by a near-identical public variant. @acme vs @acme-corp.
- Upstream Account BreachMaintainer account compromised through credential reuse, OAuth abuse, or session hijack. Depi flags the trust edge.
GITHUB ACTIONS · 6 of 14
- Action PWN RequestUnauthenticated event dispatch triggers a privileged workflow. pull_request_target with a writable secret.
- Action Cache PoisoningThe Cross-Fetch / GraphQL-JS pattern. 36M weekly downloads affected. Cache restore in a workflow you don't own.
- Action Artifact PoisoningMalicious artifact injected between pipeline jobs. Downstream jobs trust it because it has the right name.
- Short SHAMutable git reference in a workflow. Effectively no integrity guarantee. The SHA you pinned is the SHA you didn't.
- Action Environment PollutionUntrusted input written to $GITHUB_ENV. Gives an attacker arbitrary env-var control on the next step.
- Action Review InjectionPR review comment runs as workflow input. The reviewer becomes the attacker becomes the publisher.
What Depi is not.
Depi is not an SCA, not an SBOM generator, not a SAST, not a CNAPP and not a secret scanner. It does one thing, map and detect upstream supply-chain risk. Here is where each of those stops looking.
| Tool | Looks at | Misses | Depi adds |
|---|---|---|---|
SCA · Snyk, DependabotDependency scanning | Known vulnerabilities in your package list | Pipelines, registries, maintainers, undeclared build steps | Upstream chain + named attack classes + blast radius |
SBOM · FOSSA, Anchore, SyftInventory | Snapshot of package names and versions | Causation. Pipelines. Trust edges. | Live, dynamic SBOM with provenance and trust graph |
SAST · Semgrep, CodeQLCode analysis | Source code you wrote | The links around your dependencies, pipelines, maintainers, registries | The upstream surface an attacker would backdoor before code ever runs |
CNAPP · Wiz, OrcaCloud posture | Runtime risk in cloud workloads | How that workload's dependencies got built | Pre-runtime: the upstream security that produces what runs in the cloud |
Secret scanning · TruffleHogCredential detection | Hard-coded secrets in repos | Compromised maintainer credentials in registries | Maintainer trust signals at the publisher account |
Package-behavior scanning · SocketReactive triage | Each new dependency version, scanned after publish for malicious behavior | The upstream conditions that let a backdoor land in the first place | Proactive map of the maintainers, pipelines and registries that could ship a backdoor, before MTTD, not after |
