.svg)
Detect, block, and respond to supply-chain attacks.
Attackers ship malicious packages, hijacked releases, and poisoned CI actions built for the way AI agents pull in code. Heeler detects them the moment they appear, blocks them at every stage code moves, and runs the response when one lands — automatically.
ONE CONTINUOUS SYSTEM
Posture management. Prevention. Response.
Heeler hardens the repositories attackers target, blocks the attack at every stage code moves, and when new research lands, runs the response itself. One system, no gaps between the layers — together they cut supply-chain risk by more than 95%. Every pill links to its detail below.
01 · Posture management
Your own repositories, scored
Heeler secures your own repositories with the OSSF Scorecard — branch protection, code review, token permissions, pinned CI dependencies — each scored, with unpinned dependencies flagged and the whole estate ranked.
Anomalies, flagged
Behavioral checks read the GitHub audit log and flag anomalous activity even when nothing is known-malicious — a protection weakened, a destructive burst — with the evidence attached.
02 · Prevention
Code generation
In the agent
Guides the agent away from typosquats, malicious packages, and suspect hygiene — as it writes the code.
Developer workstation
Before it installs or commits
A brand-new release can't install, and a known-bad package can't commit — on the laptop itself.
The merge gate
Block at the pull request
Guardrails on your SCM's native checks — block, warn, or observe.
03 · Response
Detect
New research lands — a package that was clean at merge is flagged the moment it's known-bad. The finding raises itself.
→
Respond
A workflow opens the ticket, assigns the owning team, and messages security — 24×7.
→
Fix
Deterministic remediation delivers a validated PR to a known-good version.
↺ The fix re-enters the pipeline at the pull request — and the system keeps watching.
THE IMPACT
Before and after.
Before Heeler
✗
A campaign breaks — someone checks every repo by hand, hoping you're not exposed.
✗
The malicious package is found after its install script has already run.
✗
Unpinned installs drift silently onto compromised releases.
✗
Repository posture is audited by hand, occasionally.
✗
Cleanup depends on whoever happened to notice.
With Heeler
✓
Risky packages are stopped in the agent, at the keyboard, and at the PR.
✓
A newly flagged package raises its own finding — ticket opened, owner assigned, 24×7.
✓
Known-malicious files fail the check before merge; pinning is enforced and new releases wait out a cooldown.
✓
Every repository carries a Scorecard, and audit-log patterns raise findings on their own.
✓
The fix arrives as a validated PR to a known-good version.
IN DEPTH
The parts, in detail.
Each control from the system above, in brief — with a link to the full page where there is one.
In the agent — Agent Skills & MCP
✓
Every new dependency screened for typosquats, hijacks, and known-malicious packages — as it's added.
✓
The agent steered to the safest version: widely adopted, no active vulnerabilities.
✓
The MCP server gives any assistant the same live package intelligence.
The CLI
✓
Runs on the developer's own machine — as a pre-commit hook or a CI step.
✓
A known-malicious or typosquatted package is caught before it's ever committed.
✓
The same CLI covers vulnerabilities, licenses, and secrets.
Package-manager cooldown — install-time protection
✓
Blocks a too-new release from installing — on developer laptops, CI runners, and automation.
✓
Native to npm, pnpm, Yarn, Bun, uv, pip, and Deno, committed to the repo root — no proxy in front of your registry, no agent on the machine, applies to everyone who clones.
✓
Freshly published releases are where malicious versions live — a three-day window closes it before most are even known.
✓
Lockfile installs skip the manager's gate — pair it with the minimum-age guardrail.
Malicious-package detection & blocking
✓
Every dependency matched against threat-intelligence and advisory feeds.
✓
Deep code analysis reads packages for obfuscation, C2 calls, and postinstall hooks — novel campaigns caught before any advisory.
✓
A PR introducing a known-bad package is blocked outright.
✓
No exception mechanism for malicious code — by design.
Malicious files (IOC)
✓
A PR that adds a known-malicious file fails the check — even when no package is involved.
✓
Secret-dump scripts, web shells, worm implants: the attack's working parts.
✓
Blocking the file cuts off the access, exfiltration, or persistence it would have provided.
Unpinned dependencies
✓
Unpinned resolves to whatever is newest at install time — a compromised release lands with no diff, no review.
✓
Flagged across the estate — a one-click filter in the dependency inventory.
✓
A guardrail blocks a PR that introduces one — direct, transitive, or both.
GitHub Actions pinning & trust
✓
Workflows parsed into the full transitive action graph.
✓
Every reference classified: pinned to a commit SHA, or a tag an attacker can move.
✓
Matched against a dedicated actions advisory feed; scored on publisher trust.
✓
New unpinned, compromised, or low-trust actions gated at the PR.
Your own repositories — OSSF Scorecard
✓
17 checks: branch protection, code review, pinned CI dependencies, token permissions, signed releases.
✓
Every check carries the reason it passed or failed — actionable, not just red.
✓
Scores ship in the repositories CSV export — rank the estate, fix tier-one gaps first.
Behavioral checks
✓
Reads the GitHub audit log for your connected organizations.
✓
Flags anomalies even when nothing is known-malicious: protection weakened, required check removed, destructive bursts.
✓
Every finding keeps the underlying events attached as evidence.
Automated response
✓
The New Compromised Dependency trigger fires the moment a finding is raised.
✓
Ticket opened, owning team auto-assigned, security channel messaged.
✓
24×7 — no one watching a screen.
Deterministic remediation
✓
Computes the known-good version that clears your policy — minimum-age window included.
✓
Delivered as a validated PR — not just an alert.
✓
Compromised packages already in the tree are grouped and remediated too.
See what your dependencies are really pulling in.
A demo runs Heeler across your repos — surfacing the malicious, compromised, and unpinned packages already in your tree, each with the safe version to move to.
