oss-forensics

To investigate supply-chain attacks on GitHub repositories, you can run a phase-based workflow that aggregates evidence from the GitHub API, GH Archive, Wayback Machine, and local git history. This process preserves artifacts and correlates discrepancies to form defensible conclusions.

Open-source supply-chain forensics is the structured collection and cross-source verification of evidence to identify compromises in repositories. You need it when investigating suspicious commits, malicious package injections, or deleted artifacts that obscure evidence on GitHub.

Yes, you can recover evidence from deleted GitHub commits by querying historical data sources like the GH Archive and the Wayback Machine. Cross-referencing these sources with local git history helps identify discrepancies and preserve artifacts that were removed.

The best way to preserve chain-of-custody is using a structured evidence registry that consolidates data from multiple sources into an evidence.json file. This enforces safe data handling and detailed documentation for reproducible forensic outcomes.

No, while local git history is one of the aggregated sources, the workflow also collects data from the GitHub API, GH Archive, and Wayback Machine. Cross-source verification means investigations can proceed even if local history is incomplete.

You generate a reproducible forensic report by completing an investigation workflow that initializes, collects data, consolidates evidence, validates hypotheses, and outputs a detailed investigation report alongside an evidence registry for responsible disclosure.