Notes on keeping open source healthy and trustworthy.
The OSPulse blog is where we share what we learn watching the open-source supply chain: the attacks, the drift, and the signals that separate a safe dependency from a liability.
Latest
At-most-once, when the job runs every hour
An hourly detector re-finds the same exposures every run. Alerting on one exactly once, across retries and a Critical CVE that later escalates into KEV, is much harder than the ledger you would first reach for, and it comes down to what your deduplication key really means.
The fastest trigger produces no CVE
The supply-chain attacks that move fastest, a hijacked account, a sold domain, a package handed to a stranger, produce no CVE at the moment they matter. Every incumbent’s exploitation signal is derived from CVEs. The case for watching the source instead.
The price on the page and the price on the card
The checkout showed £249 a month. Stripe was set to take £2,988 plus VAT in one hit, and that figure appeared nowhere in the flow. How two correct numbers drifted, and the build gate that stops it happening again.
What we write about
Supply-chain attacks, dissected
Post-mortems of real incidents (event-stream, ua-parser-js, xz-utils, polyfill.io) and what signals would have flagged them before a CVE ever existed.
Dependency drift
Why the packages you shipped last year quietly become your biggest risk: abandonment, maintainer churn, and the slow rot that scanners never report.
Reading the health of open source
How we score maintenance, momentum, and risk across npm, PyPI, and beyond, and how to read those signals when you choose a dependency.
Regulation & the CRA
Practical guidance for engineering teams preparing for the EU Cyber Resilience Act and tightening expectations around software bills of materials.
Engineering at OSPulse
How we ingest nine threat feeds, traverse enormous dependency graphs, and turn noisy intelligence into a single, actionable signal.
Field notes
Shorter takes on the tooling, papers, and incidents shaping how modern teams secure their open-source estate.
While you wait
The most useful thing we can show you is your own dependency tree. See which of your packages would start a CRA Article 14 clock. Free, nothing to install.