belikebakar

These malicious npm packages often “phone home” during install or runtime, opening C2 channels, exfiltrating env vars, or beaconing quietly in the background. Static checks and SBOMs rarely catch that kind of dynamic behavior. With AI-generated or auto-installing code pipelines, that risk gets amplified since installs happen more often and less predictably. Watching what packages do at runtime feels like the next frontier here.

kernel state maps vs event buffering is an interesting choice. We've been seeing more in-memory malware in our CI/CD pipelines lately that never touches disk or network - any thoughts on extending this to userspace memory introspection?

Does it allow to integrate directly into the action runner?