Supply Chain Defense
Hunting compromised packages across every device, every night
What it does
Modern attacks increasingly arrive through the packages your software depends on rather than through your perimeter. A maintainer account gets taken over, a malicious version ships, and it installs itself on every machine that pulls the update — silently, with the same trust as legitimate code. AlertMonitor's nightly Security Validation scan inventories the actual package trees on every device and hunts for the signs of that tampering, fleet-wide, instead of trusting a lockfile to tell the truth.
Why it matters: Supply chain attacks are hard to detect precisely because the malicious code arrives through a trusted channel and looks like a routine update. Detection depends on knowing exactly which package versions are installed where — across every developer machine, server and container in the estate. That inventory is the part most organizations do not have.
Capabilities
- Inventories real installed package trees per device — npm, PyPI, RubyGems, NuGet and Composer — not just declared manifests
- Finds dependencies outside the package manager: per-project node_modules trees and Python virtualenvs discovered by walking the filesystem
- Flags packages whose installed contents do not match what the ecosystem published
- Correlates a suspicious package against every other device running it, so blast radius is known immediately
- Surfaces findings in the Supply Chain tab alongside CVE findings, with the same severity and device drill-down
- Updates are pulled from vendor and distribution repositories, preserving supply chain integrity during remediation
How it works
The agent enumerates installed packages directly from each ecosystem on the host — reading dist-info METADATA for Python, package.json manifests inside node_modules, gem specifications, NuGet package references — rather than parsing a committed lockfile. Because the inventory reflects what is actually on disk, a package that was swapped, patched post-install, or installed outside the manifest is still seen. Findings are normalized centrally, so one compromised package version is matched against the entire fleet in a single pass.