Malicious packages, stopped before they ship.

AI coding agents pull in dependencies by the dozen — and attackers now publish malicious packages, typosquats, and hijacked versions built to catch them. A single install runs arbitrary code on a laptop or a CI runner. Heeler defends the whole software supply chain at every stage: before code is written, at the keyboard, at the pull request, and continuously after merge — blocking the known-bad and catching the brand-new.

Supply-chain risk doesn't resolve at a single checkpoint.

A malicious package looks legitimate the moment it's published, sails through a merge check, and only detonates later — on install, in a postinstall hook, or in production. Any single control point misses it. You need coverage across the whole lifecycle.

01

Weaponized against agents

Attackers publish typosquats and malicious versions timed for the moment an AI agent resolves a fresh dependency — often before any advisory exists.

02

Install is code execution

A single install runs arbitrary code — obfuscated payloads, C2 callbacks, postinstall hooks — on a laptop or CI runner, before review even starts.

03

Unpinned means silent

Unpinned dependencies resolve to whatever is newest at install time, so a compromised release can land with no diff and no signal.

One risk, covered at every layer.

Supply-chain risk doesn't resolve at a single checkpoint, so Heeler covers every stage the code moves through — from continuous posture management to the workflow that routes the response. Together, the program reduces supply-chain risk by more than 95%.

Continuously

• Posture Management: Finds systemic gaps — unpinned dependencies, missing package-manager controls, unmaintained packages — before any specific threat is known.
• Before code is written: Steers AI-assisted and manual development away from risky package choices in the first place.
• Local development: Catches malicious or high-risk dependencies at the keyboard, before a pull request is ever opened.
• At pull request: Blocks or warns on known-bad packages, new dependencies that violate minimum-age policy, and new unpinned dependencies before merge.
• After merge & ongoing: The moment a malicious package is flagged, the response is immediate and orchestrated — routed, ticketed, and messaged 24/7, with no scramble to check whether you're impacted.

Known-bad and never-seen-before.

Two detection methods, one verdict. Known-malicious packages are matched instantly against threat intelligence; brand-new and obfuscated ones are caught by reading the package code itself — so a novel campaign doesn't get a free pass while it waits for an advisory.

• Known-malicious, instantly: Every dependency is matched against threat-intelligence and advisory feeds — high confidence, low noise, flagged the moment it's known.
• Novel campaigns, caught early: Deep code analysis reads packages for obfuscation, command-and-control calls, suspicious postinstall hooks, and anti-forensics — catching malicious versions before any advisory lists them.
• Typosquats & hijacks: Lookalike names and hijacked releases, aimed at the moment an agent resolves a new or renamed dependency, are surfaced for what they are.
• Unpinned & unmaintained: The systemic gaps — unpinned dependencies, abandoned packages, missing package-manager controls — that let a compromised version slip in silently.

Blocked at the pull request.

The best malicious package is the one that never merges. PR guardrails enforce policy on your SCM's native checks, and cooldown controls hold back the riskiest releases at the moment they'd install.

• Compromised dependency: Any pull request introducing a known-malicious or compromised package is blocked outright.
• Minimum release age: A cooldown holds back brand-new releases during the highest-risk window right after publish — start in observe, move to warn, then block.
• Unpinned dependency: Flag and enforce version pinning across every repo, so an install can't silently drift onto a compromised release.

A safe version to move to — not just an alert.

Finding the bad package is half the job. Heeler computes the deterministic remediation: the known-good version that clears policy, validated so the fix doesn't reintroduce risk.

• The right version, chosen for you: Remediation targets a known-good release that clears policy — including your minimum-age setting — so the upgrade doesn't trade one risk for another.
• Deterministic and validated: Upgrades are computed and compile-checked, not guessed — the same deterministic remediation that fixes vulnerable dependencies.
• Burns down the backlog: Compromised and risky packages already in your tree are grouped and remediated, not just the net-new ones.

Your pipeline runs third-party code too.

A GitHub Actions workflow pulls in actions the same way your app pulls in packages — and those actions pull in more actions, usually by a mutable tag and rarely reviewed. The tj-actions/changed-files compromise showed how one trusted action can leak the secrets of thousands of pipelines at once. Heeler treats your workflows as the supply chain they are.

• The whole action graph: Heeler parses every workflow, composite, and reusable action, then resolves the transitive tree — following each action into the actions it calls — into an SBOM alongside your app dependencies.
• Pinned to a commit, or not: Every action reference is classified: a full commit SHA is pinned; a mutable v3 tag or a branch is not — the difference between a frozen dependency and one an attacker can move under you.
• Compromised & malicious actions: The tj-actions class of attack — a trusted action turned backdoor — is matched against a dedicated actions advisory feed and blocked.
• Typosquats & impostor commits: Look-alike action names, and fork-only commits that were never reachable from the real repository, are surfaced before they ever run.