Simulating Undercover Threat Intelligence

Supply Chain Infiltration & Blast Radius Auditor

Inspired by intelligence operations infiltrating supply-chain syndicates. Model software manifests, trigger covert compromise vectors (account takeovers, dependency confusion, install-script trojans), and map transitive blast radii in real time.

Audit Controls Local Static Analysis

Scenario Presets

Package Manifest (package.json / dep-tree) Includes direct dependencies, transitive packages, and scripts.

Infiltration Threat Vector

Select Infiltration Entry Node Adversaries target unmaintained, deeply nested transitive packages.

Automated Hardening Fix Enforces hash pinning, strips postinstall scripts, and isolates scopes.

Total Packages

Primary Compromise

Infiltrated Blast Radius

Supply Risk Score

Low

Root App

Direct Dependency

Transitive Package

Compromised Entry

Infiltrated Parent Path

Selected Dependency: app-core

Clean

Depth & Tier Direct (Tier 1)

Integrity Hashes SHA512 Pinned

Execution Privileges Runs postinstall scripts

Security Assessment: No anomalous build triggers detected. Maintainer multi-factor authentication active.

Ready. Dependency tree parsed cleanly.

Undercover Defense: How Supply-Chain Infiltration Occurs

Threat actors rarely target the fortified core application directly. Instead, undercover telemetry reveals they systematically map deep transitive dependencies with single maintainers.

Maintainer Co-Option

Attackers offer benign pull requests to dormant utility libraries over months, establish trust, acquire publishing credentials or compromise developer machines, and deploy stealth backdoor updates.

Build Hook Poisoning

Scripts like preinstall and postinstall execute shell commands with developer or CI permissions upon npm install, exfiltrating cloud tokens before code is even imported.

Blast Radius Propagation

When a Tier-4 math or string helper library is poisoned, the infection propagates upward through every higher-level framework, granting attackers read/write access to production secrets.