Code you import, executing with your secrets.
A dependency can spawn shell commands, phone home, or read secrets during build while your CI logs still look clean. Static scans don't tell you what actually happens inside the runner, and this is the blind spot in supply chain attacks.
postinstall spawned shell process
2mpip install made outbound curl
8mcontainer build spawned background process
15mgo build read sensitive host file
22mdependency install posted env data
30mnpm install changed system permissions
45mpostinstall spawned shell process
2mpip install made outbound curl
8mcontainer build spawned background process
15mgo build read sensitive host file
22mdependency install posted env data
30mnpm install changed system permissions
45mpostinstall spawned shell process
2mpip install made outbound curl
8mcontainer build spawned background process
15mgo build read sensitive host file
22mdependency install posted env data
30mnpm install changed system permissions
45m
