oss-forensics-agent

Investigate a GitHub repository for a supply-chain compromise by analyzing suspicious commits, collaborator changes, and CI pipeline modifications to extract IOCs and reconstruct event timelines for forensic reporting.

Detect indicators of compromise in open-source projects by collecting data from GitHub APIs, GH Archive, Wayback Machine, and package registries to identify suspicious commits and compromised maintainers.

Yes, you can generate a forensic timeline by collecting repository evidence from GitHub APIs and Wayback Machine, extracting IOCs from suspicious commits, and reconstructing event timelines for threat-intel monitoring.

Yes, GitHub API access is required to collect comprehensive evidence for open-source forensics, and optional repository cloning is supported to extract additional indicators of compromise.

CI pipeline modification analysis helps detect compromised maintainers by identifying unauthorized changes to continuous integration configurations, reconstructing event timelines, and generating detailed forensic reports for executive escalation.

Investigating package registries for supply-chain attacks relies on available historical data from GH Archive and Wayback Machine, meaning investigations may be limited if repositories or package registries lack comprehensive public logs.