axios
1.14.1 · npm
RAT
2026
We watch what packages actually do.
Every install executes someone else's code. Manticore runs every install and update in an isolated sandbox, records what it does, and catches malicious behavior on the spot.
PackageVersionStatusScoreFlags
eslint9.14.0completed0.0-
axios1.7.7completed0.0-
date-fns4.1.0completed0.0-
@typescript-eslint/parser8.13.0completed0.0-
vite5.4.10completed0.0-
ts-gaussian3.0.5completed100.0[NET & FILE & PROC]
zod3.23.8completed0.0-
@types/react18.3.12completed0.0-
react-dom18.3.1completed0.0-
tailwindcss3.4.14completed0.0-
@vitejs/plugin-react4.3.3completed0.0-
typescript5.6.3completed0.0-
pino9.5.0completed0.0-
THREAT FOUND. SEVERITY: CRITICAL
New version. No prior reports. Flagged on behavior.
MANTICORE SECURITY SCAN RESULTS
35 packages scanned · 1 suspicious · highest severity CRITICAL
ts-gaussian 3.0.5
Score 100 / 100 · Severity Critical · 1 Critical · 3 High findings
● CRITICAL · CREDENTIAL EXFILTRATION
Sensitive credential or file access combined with unknown network activity.
● HIGH · SENSITIVE ENV ACCESS
GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY_ID
● HIGH · SENSITIVE FILE ACCESS
~/.ssh/id_rsa (read), ~/.aws/credentials (read)
● HIGH · UNKNOWN NETWORK
169.254.169.254:80/tcp (cloud metadata endpoint)
File AccessOutbound NetworkCredential ReadProcess Spawn
The problem
#1 Supply chain attacks are the most common attack vector. Kaspersky, 3/2026
464,650 malicious open source packages detected in Q2 2026 alone. Sonatype, 7/2026
1/3 of global enterprises were impacted by a supply chain attack over the past 12 months. Kaspersky, 3/2026
The behavior is the evidence.
One command in your pipeline. Available for GitHub Actions, GitLab CI, self-hosted.
Runs every package in isolation.
Locked sandbox, restricted network access. Captures install and runtime behavior. Designed to trigger payloads that hide from static review.
Records the signals that matter.
File reads, outbound connections, process launches, recorded as a behavioral fingerprint while the code runs. Obfuscation doesn't hide behavior.
Fits your pipeline.
CI/CD gate, PR/MR comments, automatic build block on threshold. Instant verdicts for known versions, a sandbox run only when a version is new.
Delivers the verdict.
Machine-readable findings showing detected risks and executed commands. And because verdicts come from observed behavior, false positives stay rare.
Transparency.
Open source CLI
The CLI source is public and MIT licensed. Read it before you run it.
SHA-256 signed releases
Every binary is checksummed and digitally signed. The Action verifies both before execution.
Versioned and pinned
Releases are tagged and pinned. Reproducible builds, an auditable supply chain, no moving targets.
46 seconds. A known package. A malicious payload.
We're not inspecting. We're running it.
A different package. A different way in. A different campaign. The behavior stays the same.
LiteLLM
1.82.7 · PyPI
malicious code
via proxy module and .pth files
2026
Shai-Hulud 2.0
npm
self-replicating worm
27k+ repos
The package changes. The behavior doesn't. All flagged by Manticore's behavioral analysis.
Updating a dependency is an act of trust.
Supply chain attacks arrive through legitimate packages and real maintainer accounts. Nothing looks wrong in the diff. Behavioral analysis catches what review cannot: what the package actually does when it runs.
Book a demo