postmortem - Supply-chain scanner. Flags malicious install code

项目说明

<p align="center">
<img src=".github/banner.png" alt="postmortem">
</p>

<h1 align="center">postmortem</h1>

<p align="center">
<b>Catch a supply-chain attack before it ships.</b><br>
A fast supply-chain security scanner for the code you depend on.
</p>

<p align="center">
Single static binary&nbsp;&middot;&nbsp;No telemetry&nbsp;&middot;&nbsp;No daemon&nbsp;&middot;&nbsp;Network only when you ask
</p>

---
![Postmortem ]()

Modern software is mostly other people's code. postmortem inspects that code the
way an attacker's payload actually reaches you: through install hooks, typosquats,
hijacked maintainer accounts, and freshly-transferred repos. It reads your
lockfiles across se ecosystems, reconstructs the full dependency
graph, and flags what real compromises look like.

Why postmortem

* Fits behind a corporate proxy. A network block in ~/.postmortem/config.yml
sets the proxy, its no_proxy exemptions, a corporate root CA (ca_cert), and
a base-URL o for every service (or per run: --proxy, --no-proxy,
--ca-cert) — internal mirrors, GitHub Enterprise, a self-hosted GitLab. A typo in
a key is an error, never a silent fallback to the public registry.
* No telemetry. postmortem ne home. It reaches the network only on
the paths that need it — --online reputation and --vulns / system --vulns
ad lookups — and even then only sends the package coordinates being
queried.
* Finds attacks, not just CVEs. Malicious install scripts, obfuscated
payloads, embedded IOCs (IPs, domains, wallets), typosquats across six
ecosystems (npm, PyPI, crates.io, RubyGems, Packagist, Go — offline, each
against its own corpus), and pro
anomalies (new publisher, dormant release, an install script that appeared out
of nowhere).
* Reputation intelligence. Score every dependency on its real source repo
(stars, age, activity, language) across GitHub, GitLab, and Codeberg.
* Maintainer graph. tree --human ranks the *accounts* that control your
tree by what a compromise of each would reach — the unit that actually gets
phished. On a real 466-package project: 3 accounts control 41% of it.
* Audit your machine too. system inspects your OS packages (Homebrew,
Arch/pacman, Debian/Ubuntu apt, Fedora/RHEL dnf, Nix, and Alpine apk): unsigned
or third-party sources, PPAs and AUR builds, un store paths,
install-time hooks, setuid binaries and file di, weakened signing
trust, and tampered files — plus system --vulns for known CVEs (OSV for
apt/apk/dnf, the Arch Security Tracker for pacman).
* Windows too, all of it. A Windows machine has no single package manager, so
system reads every layer and merges them into one view: WinGet, MSIX/AppX,
Chocolatey, Scoop, and e Add/Remo records — including what
no manager claims. On top of that it reads what the machine *runs*: auto-start
entries, scheduled tasks, services and drivers, image hijacks and BITS jobs,
and its pri posture (UAC, LSA, PATH and ACL weaknesses, Defender policy,
firmware) — with network posture (hosts, proxies, DNS, root CAs) under
--deep. Every binary is checked against its Authenticode signature.
* Deep source inspection. system inspect <pkg> --deep clones every
dependency's real source and runs the full detection suite over it.
* CI-ready. Every command has a machine format — JSON throughout, SARIF for
GitHub Code Scanning, and a self-contained HTML report from scan and tree.
Plus a configurable gate — shared by tree, audit and system — that fails
the build on risk. Thresholds are fail-closed: asking for a check the run could
not perform exits 2 rather than passing.
* Licenses, honestly. A CycloneDX SBOM with a real licenses array, plus a
licenses command and a deny/allow policy that fails the build. Read offline
for Node and PHP; elsewhere from the same registry call reputation already
makes. An identifier we can't is reported as free text, ne as
an SPDX id a consumer would reject the whole document over.
* Ships-only view. --omit dev drops your test and build tooling from every
count, score and C. Scope is computed by reachability, not by what a
manifest happens to list — so a package your application also uses is never
dropped, however deep the dev tree it also appears in.
* Honest. A flat or unparseable graph raises a diagnostic, so 0 findings is
ne for "clean" — and an --omit that remo says so, in
the terminal and in the JSON.

Quick start

Install

Homebrew

Scoop (Windows)

apt (Debian / Ubuntu)

The signing key fingerprint is 717894BC C0E057E4 F9BBF3CA C0E287DD 9609A065 — check it
with gpg --show-keys --with-fingerprint /etc/apt/keyrings/postmortem.asc before trusting
the repository.

Prebuilt binary (macOS, Linux and Windows, arm64 and x86_64): grab a tarball
— or a zip on Windows — from the
releases page.

From source (a recent Rust toolchain):

What's inside

| Command | What it does |
|---|---|
| scan | Static analysis of dependency code for malicious patterns, fully local. |
| tree | Dependency graph, plus online reputation, pro, and known- intelligence. |
| audit | One-shot graded health check: malware scan + in, plus optional reputation and vulns. |
| licenses | License in across the graph, with a deny / allow / fail-on-unknown policy. |
| fix | Turn the report into the change that clears it: minimum upgrade, direct command or o snippet. |
| why | Explain why a package is installed — and with --blast, what a compromise of it would reach. |
| diff | Compare two project states — or a GitHub PR by URL — and assess what the change introduces. |
| sbom | Export the resol graph as a CycloneDX 1.5 SBOM. |
| system | Audit your machine's OS package managers — Linux, macOS and Windows — and deep-inspect any package's real source. |
| scripts | Which dependencies execute code at install time, whether each is approved, and what its script does. |
| hook | Git pre-commit hook for staged dependency changes. |
| timeline | Lay a package's release history out in order: handovers, install scripts, repository moves. |
| hunt | An attack just dropped: which of your projects pinned it — now or at any point in git history — and from when to when. |
| ghost | Diff each npm dependency's published tarball against the commit it was published from — code nobody could ha. |
| ci | Print a ready-to-commit pipeline for GitLab CI, Azure DevOps, Jenkins or GitHub Actions. |
| allowlist | Every suppression the project declares, with how long each has left to run. |
| cache | Manage the local cache used by the online paths. |

Ecosystems: Node (npm / pnpm / yarn), Python, Rust, Ruby, PHP, Go, and
Java / Kotlin. Source-code scanning additionally covers C, C++, and Perl.

See CHANGELOG.md for what changed in each release.

Documentation

The full manual lives in the
wiki:

* Commands: scan, tree, system, cache
* Ecosystems and hosts
* Online resolution and scoring
* Licenses and dependency scopes
* Source-code scanning
* Windows: the merged layer-by-layer machine audit
* CI gate, CI templates and Configuration

License

See LICENSE.

<p align="center"><i>
Don't dig up the corpse to find the cause of death after the breach.<br>
Do it before you ship the dependency.
</i></p>

项目信息

开发语言：Rust

Star 数：10

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Supply-chain scanner. Flags malicious install code, typosquats, and shady provenance across your dependencies and your OS packages. Repo-reputation scoring, known-CVE intel, no telemetry.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。