Your code depends on thousands of strangers
Mallory tracks software supply chain attacks as they surface and tells you whether a compromised package is in your code.
What is a software supply chain attack?
A software supply chain attack compromises something you trust, such as an open source software (OSS) package, a build tool, or a vendor update, so malicious code reaches you through a normal install.
Compromised packages show up on npm and PyPI every day. Mallory tracks each one as it's reported and checks it against your code.
See the software behind your vendors
One exploited repository can be used by dozens of suppliers. Ask Mallory to map it and get a graph of every vendor it reaches.
From compliance artifact to live defense
Mallory connects your software composition data to real-time threat intelligence. When a component is vulnerable or compromised, you know which services are affected and who needs to remediate.
Dependency intelligence
Mallory ingests your SBOMs, lock files, and container manifests to build a live map of every open-source component across your software portfolio. When a vulnerability is disclosed against any dependency, direct or transitive, you know immediately.
- SBOM ingestion across all major formats (CycloneDX, SPDX)
- Transitive dependency resolution to the full depth of your tree
- Continuous monitoring against CVE disclosures and exploit intelligence
Compromised package detection
Not every software supply chain threat is a CVE. Malicious packages, typosquatting, maintainer account takeovers, and backdoors require a different kind of intelligence. Mallory monitors for these threats across package registries and dark web sources.
- Monitoring for malicious packages across npm, PyPI, Maven, and more
- Alerts on maintainer account compromises and suspicious package updates
- Dark web tracking for leaked credentials tied to open-source infrastructure
Instant impact assessment
A Log4Shell-class event drops. Mallory tells you within minutes which services, repositories, and container images use the affected component, which version, whether it's in production, and who owns the remediation.
- Cross-repository and cross-service component search
- Version-level matching against affected version ranges
- Asset owner identification for fast remediation routing
From SBOM compliance to operational defense
Turn your SBOMs from compliance artifacts into live security tools. Mallory continuously correlates your software inventory against threat intelligence so every component is tracked, every vulnerability is surfaced, and every remediation is assigned.
- Live SBOM dashboards with vulnerability and risk overlay
- Automated ticket generation when a new CVE affects your components
- Compliance reporting with audit-ready evidence of remediation
Are we affected? Ask.
Every compromised package, ranked by compromise evidence. See what was published, what the code does, and every source that reported it. Ask the Mallory Agent to check the list against your GitHub repos. You get coverage, matches, and what to do next.
Built for teams securing the software they ship
AppSec and product security
Know which services ship the bad version.
Security operations
Answer "are we affected?" before the ticket arrives.
Engineering and DevSecOps
Get the fix, not a 200-line SBOM differential.
Frequently asked questions
XZ Utils (2024): a backdoor was planted in a widely used compression library. event-stream (2018): a popular npm package picked up a malicious dependency aimed at crypto wallets. ua-parser-js (2021): attackers hijacked the maintainer's account and published versions carrying a cryptominer and a password stealer.
Mallory tracks compromise reports from researchers, registries, and social sources, and groups them into one story per package. Each story shows what was published, what the code does, a timeline, and every source that reported it.
Yes. Ask the Mallory Agent to check the compromised-package list against your GitHub repositories. It reports how many repos it scanned, any matches, and what to do next.
Yes. Set up the audit once, and Mallory runs it on the schedule you choose, such as daily at 6 a.m. Each run refreshes the list, checks your repos, and emails you the results.
Software supply chain security covers the code you ship and the packages it depends on. Third-party supply chain risk intelligence covers the vendors and suppliers you work with.
Related use cases
Third-party supply chain risk intelligence
Know the moment a vendor is breached, and which of your systems depend on them.
Learn moreSecurity workflow automation
Turn findings into routed, ticketed work without the copy-paste.
Learn moreExposure investigation
Answer "are we affected?" in minutes, with the evidence attached.
Learn moreThe next XZ Utils is coming. Know your exposure.
Full platform access · 14-day free trial · No credit card required