Hello all. I'm Rob. I build OSPulse at Fortitude Omnis Group Ltd, a small indie company taking on the VC-funded supply-chain names (Snyk, Sonatype, Socket) with no funding and no sales team. The product page is the whole pitch.
What it does: most dependency tools wait for a CVE. I care about the window before one exists, where a package changes hands, an npm account gets hijacked, or a maintainer quietly burns out. event-stream, ua-parser-js, polyfill.io and xz all showed their signs at the source weeks or months before anyone assigned a number. So OSPulse scores project health, maintainer churn, commit-velocity collapse, ownership changes, instead of the length of a vulnerability list. It ingests more than ten feeds, and I'll tell you which detections it misses as readily as the ones it catches.
On the R&D side, the piece I'm proudest of is PoisonBox. Every npm install detonates in its own disposable microVM with hardware-level isolation. It boots, does its worst, and is deleted, so nothing it does touches your machine or your keys. Underneath, an eBPF probe in the kernel logs every process spawned, file opened, secret read and outbound connection, from below the code where the package can't hide. It then draws the causal thread from the instant a package reads your npm token to the connection that carried it off. With malicious packages the hard part is proving exactly what happened and in what order, and that trace is how.
A confession, since honesty is about the only thing separating a security tool from its own marketing. Our checkout showed £249 a month while Stripe was quietly set to take £2,988 in a single hit, a figure that appeared nowhere in the journey. Two systems each holding a correct version of the same number, disagreeing only at the instant of the charge, the one moment the website never sees. It's fixed now (the price is one constant everything derives from, with a test that fails the build if the disclosure ever drops off the page), and it was caught before a single customer paid, which is the only reason I get to tell it as a story instead of a refund.
Great to meet you all.
Top comments (0)