oss-forensics

To investigate supply chain security incidents, collect and correlate evidence from GitHub API, local Git analysis, and web archives. This framework analyzes force-push events and deleted content by applying cross-source verification to build credible forensic reports.

The best way to extract IOCs from a compromised repository is using a structured phase-driven workflow. This framework applies evidence-first validation across GitHub Archive, Wayback Machine, and CI/CD data to identify indicators of compromise while preventing hallucinated findings.

Generate a forensic report by completing the multi-phase investigation workflow and populating a reusable evidence store. The framework normalizes collected evidence, forms evidence-backed hypotheses, and outputs a structured final report template suitable for responsible disclosure.

Yes, you can use GitHub Archive and Wayback Machine data together for cross-source verification. The framework integrates BigQuery, web archives, and local Git analysis to correlate evidence across multiple sources, ensuring credible findings for supply chain attacks.

The OSS forensics investigation framework operates without external dependencies. It orchestrates evidence collection and hypothesis validation through built-in scripts and reference components, guiding users from initialization through final report generation.

Start an open-source repository investigation by initializing an investigation directory and gathering evidence using the evidence-store tool. The framework's Phase 0 initialization sets up the environment before progressing through evidence collection and hypothesis validation.