oss-forensics

To investigate a GitHub repository for supply chain attacks, you analyze deleted commits, force-pushes, and suspicious commits. A structured forensic framework automates evidence collection from the GitHub API and local git history to validate hypotheses and uncover indicators of compromise.

Forensic analysis of open-source software is the structured investigation of repositories to detect compromised dependencies and malicious activities. It correlates evidence from sources like the Wayback Machine to form hypotheses, validate security incidents, and extract indicators of compromise.

To extract indicators of compromise from a suspicious GitHub commit, you track commit SHAs, file paths, and malicious URLs. Automated evidence collection correlates these artifacts across git history to identify anomalies and validate supply chain security incidents.

Yes, you can detect deleted commits and force-pushes by utilizing the GitHub API and local git analysis. Tracking these anomalies across repository history is a core component of identifying suspicious actor behavior and potential supply chain security compromises.

Git forensics works with the Wayback Machine to retrieve historical repository states for supply chain security investigations. This integration automates evidence collection across multiple parallel investigators, ensuring evidence-first practices when validating compromised dependencies.

The best way to generate a forensic report for a compromised package is to use a structured investigation framework. It synthesizes collected evidence into a detailed narrative containing a summary, timeline, validated hypotheses, and a comprehensive list of extracted indicators of compromise.