Every advisory
is a crime scene.
The package was clean yesterday. Today it's shipping to production. Depi works the case, who changed it, how it reaches you, and how to shut it down, before the trail goes cold.
Anyone can take the tip.
Depi works the case.
A public advisory is an anonymous tip, loud, vague, the same for everyone. Depi turns it into a dossier on your software: who's exposed, how deep it runs, and what to do about it tonight.
170+ packages: TanStack npm supply chain compromise
Affected projects
| Project | Status |
|---|---|
my-project2/2 | Resolved |
| @tanstack/react-router | Resolved |
| @tanstack/history | Resolved |
| @tanstack/react-router-devtools | Ignored |
my-api1/1 | Resolved |
| @tanstack/react-router | Resolved |
my-data-pipeline1/1 | Resolved |
| @mistralai/mistralai | Resolved |
my-web2/2 | Resolved |
| @tanstack/react-router | Resolved |
| @tanstack/arktype-adapter | Resolved |
my-worker1/1 | Resolved |
| @tanstack/history | Resolved |
my-mobile-bff1 ignored | Ignored |
| @tanstack/eslint-plugin-router | Ignored |
Working the case.
The moment a signal lands, the investigation runs itself. No analyst pulling threads at 3 a.m., no spreadsheet, no waiting on the ecosystem to catch up.
Match
A case opens from an advisory link, the Depi team or a malware feed. Depi checks the affected versions against every manifest it scans, transitive dependencies included.
Trace
Each hit shows the project, the manifest, the version and how it got pulled in. Then the CI runs in the exposure window: the secrets they read, the write scopes they held.
Resolve
Every rescan marks the projects that moved past the affected range as resolved. Ignore what doesn't apply. When nothing vulnerable is left, the case resolves.
Every case has a clock.
The longer it runs, the colder the trail.
Everyone finds out eventually. The teams that contain it are the ones who already knew their exposure when the advisory dropped. Depi closes the gap before the clock even starts.
Maintainer takeover paths
Expired maintainer email domains, hijackable nameserver delegations, organization and package takeovers, and maintainer credentials exposed in breach data.
Pipeline attack classes
The workflows that build and publish your dependencies, read for pwn requests, TOCTOU windows, cache and artifact poisoning, short-SHA pinning and script injection.
Registry confusion
Unclaimed package names, dependency, workspace, manifest and NPX confusion, freshly claimed names with no history, and packages already flagged malicious.
