DepthCharge — Software Supply Chain Defense

Detection Engine

Three independent layers, one verdict

Each layer fails differently — so they're stacked in depth. A package must survive reputation, static inspection, and live execution to come back clean.

LAYER 01

Reputation

Surface · metadata & intelligence

Typosquatting via Levenshtein distance
Suspicious age, low release count, hidden author
Maintainer e-mail change (account takeover)
Known CVEs / GHSAs via OSV

LAYER 02

Static

Mid-water · code without execution

Dangerous AST patterns, hook-context aware
YARA rules: Base64 eval, reverse shells, tokens
Shannon entropy → obfuscated payloads
Intra-procedural taint analysis (source → sink)

LAYER 03

Dynamic

Deep · isolated execution

Hardened Docker container, --network none
strace syscall tracing: connect / execve / open
Python function instrumentation
Flags egress, file leaks, suspicious spawns

Risk Scoring

A depth gauge for risk

0–14

LowPackage likely safe — ship it.

15–69

MediumManual review recommended.

70–100

HighPull request blocked automatically.

Weighted & additive, with cross-layer correlation bonuses (obfuscation and outbound network scores more than either alone) and a strict whitelist that suppresses false positives on trusted packages.

MITRE ATT&CK

From finding to technique

TechniqueTrigger

T1195.001Compromise software dependencies — typosquat, known malware

T1027Obfuscated files — high entropy, Base64, chr() rebuild

T1059.006Python interpreter — eval/exec in install hook

T1552Unsecured credentials — env vars read & sent

T1041Exfiltration over C2 — outbound connection in sandbox

T1547Persistence — sitecustomize.py / ~/.bashrc edit

Architecture

A modular pipeline, decoupled by a data contract

The core orchestrates three scanners that all emit the same JSON shape. The scorer, dashboard and CI gate consume any module interchangeably — which let four people build in parallel.

pipeline.flow

  Input  CLI · Dashboard · CI
    │
    ▼
┌─ Core engine ─ depthcharge.py ─────────────┐
│   ├─▶ Reputation      → PyPI / npm / OSV    │
│   ├─▶ Static (AST/YARA/entropy/taint)       │
│   └─▶ Dynamic sandbox → Docker --network none │
└──────────────┬──────────────────────────────┘
               ▼
       Risk scorer · scorer.py  # correlation + whitelist
               ▼
       SQLite  # history + inventory
               ▼
   Verdict · Dashboard · Reports · CI gate (fail-on-high)

Positioning

Why DepthCharge

Vulnerability scanners miss novel malware. Malware detectors reason on code, not behavior. DepthCharge is the only self-hostable tool combining all three layers with ATT&CK mapping and compliance built in.

Tool	Reputation	Static	Sandbox	CVE/OSV	ATT&CK	Compliance	CI/CD	OSS
Dependabot / pip-audit	✗	✗	✗	✓	✗	✗	✓	✓
OSV-Scanner	✗	✗	✗	✓	✗	✗	✓	✓
Snyk	∼	∼	✗	✓	✗	∼	✓	✗
Socket.dev	✓	✓	∼	✓	✗	∼	✓	✗
GuardDog	✓	✓	✗	∼	✗	✗	✓	✓
DepthCharge	✓	✓	✓	✓	✓	✓	✓	✓