Detect supply-chain attacks in your npm builds
Lockfiles and SBOMs list what a build declares. Protet records what the build actually executes and flags the npm builds that behave like a supply-chain attack.
Protet Intel
Malicious npm packages, confirmed in the open
Protet installs newly published npm packages in an isolated environment, watches what they run, and publishes the ones a reviewer confirms as malicious.
- confirmed malicious
- 122
- npm version-days screened: each version counted once per day it was screened (how)
- 160,179
See every confirmed package on Protet Intel · Read the latest disclosure
What you get
Findings you can act on
Attacks caught when they run
A postinstall script that pipes a download into a shell, or a dependency that reads your cloud credentials, is flagged during the build that runs it.
A result for every build
Every analysed build returns a verdict, benign or malicious, so a clean build is confirmed rather than just silent.
Findings in your SIEM
Each verdict is an OCSF Detection Finding, an open schema most SIEMs read. No new console to watch. Schema.
Get started
Two ways to start
Both use the same free account and token.
GitHub Actions
Add one step to a workflow. Your build steps do not change.
Preview: the GitHub Action is in preview. npm builds only.
.github/workflows/build.yml
- uses: protet/monitor@v1
with:
token: ${{ secrets.PROTET_TOKEN }}
ecosystem: npm
Your own runners, one API
Run Tetragon yourself and send its events to the ingest API. npm builds only.
How it works
Collect, detect, deliver
Protet collects process activity from the GitHub Action, a Kubernetes sensor or the API, checks every build, flags the ones that behave like an attack and delivers each result as an OCSF finding. Every detection update is regression-tested before release.
Deployment
Runs where your data has to stay
Protet is free and cloud-hosted, on Swiss infrastructure. On-prem and air-gapped deployments, with signed detection bundles verified offline, are available on request: hello@protet.io.
Free to use
Sign up, mint a token and add the Action. Usage is capped monthly; no card needed.