postmortem

Catch a supply-chain attack before it ships.
A fast, offline-first security scanner for the code you depend on.

Single static binary · No telemetry · No daemon · Network only when you ask

---

Modern software is mostly other people's code. postmortem inspects that code the way an attacker's payload actually reaches you: through install hooks, typosquats, hijacked maintainer accounts, and freshly-transferred repos. It reads your lockfiles across seven language ecosystems, reconstructs the full dependency graph, and flags what real compromises look like. All offline by default.

Why postmortem

• Offline by default. scan never touches the network. Nothing leaves your machine unless you explicitly pass --online or --vulns.
• Finds attacks, not just CVEs. Malicious install scripts, obfuscated payloads, embedded IOCs (IPs, domains, wallets), typosquats, and provenance anomalies (new publisher, dormant release, an install script that appeared out of nowhere).
• Reputation intelligence. Score every dependency on its real source repo (stars, age, activity, language) across GitHub, GitLab, and Codeberg.
• Audit your machine too. system inspects your OS packages (Homebrew, Arch/pacman, Debian/Ubuntu apt, Fedora/RHEL dnf, Nix, and Alpine apk): unsigned or third-party sources, PPAs and AUR builds, unverified store paths, install-time hooks, setuid binaries and file diversions, weakened signing trust, and tampered files.
• Deep source inspection. system inspect <pkg> --deep clones every dependency's real source and runs the full detection suite over it.
• CI-ready. JSON and SARIF (GitHub Code Scanning) output, plus a configurable gate that fails the build on risk.
• Honest. A flat or unparseable graph raises a diagnostic, so 0 findings is never mistaken for "clean".

Quick start

postmortem scan .                       # find malicious code, fully offline
postmortem tree . --online              # score dependencies by repo reputation
postmortem tree . --online --vulns      # add known CVE / GHSA / OSV advisories
postmortem audit . --online --vulns     # one graded verdict: malware + risk + CVEs
postmortem why left-pad .               # why is this package installed?
postmortem diff ./main ./pr-branch      # what dependencies did this change add?
postmortem sbom . -o sbom.json          # export a CycloneDX 1.5 SBOM
postmortem system                       # audit your installed OS packages
postmortem system inspect wget --deep   # clone + audit one package's full source

Install

Homebrew

brew tap mlab-sh/postmortem https://github.com/mlab-sh/postmortem.git
brew install postmortem

Prebuilt binary (macOS and Linux, arm64 and x86_64): grab a tarball from the releases page.

From source (a recent Rust toolchain):

git clone https://github.com/mlab-sh/postmortem.git
cd postmortem && cargo build --release

What's inside

Command	What it does
scan	Offline static analysis of dependency code for malicious patterns.
tree	Dependency graph, plus online reputation, provenance, and known-vulnerability intelligence.
audit	One-shot graded health check: malware scan + inventory, plus optional reputation and vulns.
why	Explain why a package is installed: its dependency paths up to the roots.
diff	Compare two project states: added / removed / version-changed dependencies.
sbom	Export the resolved dependency graph as a CycloneDX 1.5 SBOM.
system	Audit your machine's OS package managers, and deep-inspect any package's real source.
cache	Manage the local cache used by the online paths.

Ecosystems: Node (npm / pnpm / yarn), Python, Rust, Ruby, PHP, Go, and Java / Kotlin. Source-code scanning additionally covers C, C++, and Perl.

Documentation

The full manual lives in the wiki:

• Commands: scan, tree, system, cache
• Ecosystems and hosts
• Online resolution and scoring
• Source-code scanning
• CI gate and Configuration

License

See LICENSE.

Don't dig up the corpse to find the cause of death after the breach.
Do it before you ship the dependency.