spectra-assure

You can detect package tampering and malware by scanning manifest files like requirements.txt or package.json using behavioral differential analysis. This process diffs behavioral changes between package versions to catch hidden malicious insertions that signature-based scanning tools routinely miss.

Behavioral differential analysis finds malicious insertions by comparing the runtime behavior of two versions of the same package. It identifies new network endpoints, shell execution indicators, and filesystem writes that signal a dependency has been compromised or tampered with.

Yes, you can scan lockfiles and manifest files for supply chain security risks, malware, and policy violations. The tool evaluates individual packages by PURL and parses dependency manifests to identify vulnerabilities and tampering indicators.

Yes, you need valid ReversingLabs API credentials to execute scans and interpret risk findings. You must provide an RL_TOKEN, and Enterprise users also need to configure RL_PORTAL_SERVER and RL_PORTAL_ORG environment variables to generate reports.

To triage a suspicious minor dependency upgrade, diff the old and new versions using behavioral analysis to identify new network endpoints or shell execution indicators. This helps determine if the unexpected update introduces tampering or malicious behavior.

Yes, package scanning helps with compliance attestation by mapping security findings to NIST SSDF, EO 14028, and OWASP A06:2021 requirements. It generates reports that document vulnerability scans and supply chain risk assessments for audit workflows.