oss-forensics

To recover deleted commits after a force push on GitHub, you can fetch orphaned commits via local git analysis, query the GitHub REST API, and retrieve archived pages from the Wayback Machine to reconstruct the commit timeline.

Supply-chain forensics for open source repositories is the investigation of GitHub repositories to detect compromises, recover erased commits, and extract forensic indicators of compromise to validate hypotheses about maintainer takeover or malicious dependency injection.

To investigate a suspected malicious dependency injection, you apply local git analysis, GitHub REST API queries, GH Archive BigQuery searches, and IOC enrichment to detect malicious dependency changes and produce an auditable forensic report with cited evidence.

You do not need BigQuery credentials strictly for IOC extraction, but they are optional and required if you want to run GH Archive searches to correlate supply-chain proofs across multiple sources.

The best way to detect CI workflow anomalies in a compromised repository is using multi-source evidence collection that cross-references local git history, GitHub REST API data, and Wayback Machine snapshots to identify unauthorized modifications.

A key limitation when reconstructing timelines from orphaned git commits is that anti-hallucination rules require multi-source verification before stating facts, meaning uncorroborated orphaned commits alone may not be sufficient for the final forensic report.