postmortem

Catch a supply-chain attack before it ships.
A fast, offline-first security scanner for the code you depend on.

Single static binary · No telemetry · No daemon · Network only when you ask

---

Modern software is mostly other people's code. postmortem inspects that code the way an attacker's payload actually reaches you: through install hooks, typosquats, hijacked maintainer accounts, and freshly-transferred repos. It reads your lockfiles across seven language ecosystems, reconstructs the full dependency graph, and flags what real compromises look like. All offline by default.

Why postmortem

• Offline by default. scan never touches the network. Nothing leaves your machine unless you explicitly pass --online or --vulns.
• Finds attacks, not just CVEs. Malicious install scripts, obfuscated payloads, embedded IOCs (IPs, domains, wallets), typosquats, and provenance anomalies (new publisher, dormant release, an install script that appeared out of nowhere).
• Reputation intelligence. Score every dependency on its real source repo (stars, age, activity, language) across GitHub, GitLab, and Codeberg.
• Audit your machine too. system inspects your OS packages (Homebrew): formulae, casks, third-party taps, unverified downloads, and anything that runs at boot.
• Deep source inspection. system inspect <pkg> --deep clones every dependency's real source and runs the full detection suite over it.
• CI-ready. JSON and SARIF (GitHub Code Scanning) output, plus a configurable gate that fails the build on risk.
• Honest. A flat or unparseable graph raises a diagnostic, so 0 findings is never mistaken for "clean".

Quick start

postmortem scan .                       # find malicious code, fully offline
postmortem tree . --online              # score dependencies by repo reputation
postmortem tree . --online --vulns      # add known CVE / GHSA / OSV advisories
postmortem system                       # audit installed Homebrew packages
postmortem system inspect wget --deep   # clone + audit one package's full source

Install

Homebrew

brew tap mlab-sh/postmortem https://github.com/mlab-sh/postmortem.git
brew install postmortem

Prebuilt binary (macOS and Linux, arm64 and x86_64): grab a tarball from the releases page.

From source (a recent Rust toolchain):

git clone https://github.com/mlab-sh/postmortem.git
cd postmortem && cargo build --release

What's inside

Command	What it does
scan	Offline static analysis of dependency code for malicious patterns.
tree	Dependency graph, plus online reputation, provenance, and known-vulnerability intelligence.
system	Audit your machine's OS package managers, and deep-inspect any package's real source.
cache	Manage the local cache used by the online paths.

Ecosystems: Node (npm / pnpm / yarn), Python, Rust, Ruby, PHP, Go, and Java / Kotlin. Source-code scanning additionally covers C, C++, and Perl.

Documentation

The full manual lives in the wiki:

• Commands: scan, tree, system, cache
• Ecosystems and hosts
• Online resolution and scoring
• Source-code scanning
• CI gate and Configuration

License

See LICENSE.

Don't dig up the corpse to find the cause of death after the breach.
Do it before you ship the dependency.