Supply chain blast radius
When an npm account is compromised, the worm republishes everything that account owns. HyperDefense models dependencies, maintainer accounts, and the publish timeline as three graphs in HydraDB, so the second question has an answer.
body-parser, real npm data, reproducible offline
MIT · built on HydraDB traversals and its native algo.MSpaths · 105 passing tests · every verdict is deterministic
Explore
npm run demo -- --reset first.
Resolves the bad code
Reachable through a shared account
Attack paths
A set of names tells you the scale. A path tells you the intermediate
package that pulls the code in, which is where the link can be cut. This
uses HydraDB's native algo.MSpaths procedure.
CI gate
The same check that runs in CI, against two real lockfiles: an application that resolved the compromised version, and this repository's own. It reads the lockfile rather than package.json, because a compromise is about the version that actually resolved.
How it works
01 / Dependency
Who transitively depends on the compromised package. A bounded variable-length traversal over a materialised reverse edge.
02 / Maintainer
Which other packages share a publishing account. Two hops through a maintainer node. The layer commercial scanners skip.
03 / Temporal
The publish timeline, so a compromise window names the first suspect version and the last clean one to pin back to.
Every verdict is rule-based. No model is consulted, so the same graph and inputs produce identical output on every run.