Supply chain attacks are starting to feel like part of the daily routine.
You grab your morning coffee, open the laptop, and check which package ecosystem is on fire today.
Malicious packages, compromised maintainers, typosquatting, dependency confusion, suspicious new releases — the public package ecosystem is powerful, but we also trust it a lot by default.
There are mature tools for this. JFrog, Sonatype, Synk, and similar platforms exist for a reason. But not every small team, startup is ready to buy and operate a full artifact-management platform.
So I started thinking about the gap between:
