Find dependencies whose maintainers are compromised

Every package security tool analyses the artifact. This answers the question none of them can: is the human who is able to publish that artifact compromised right now?

A self-replicating npm worm does not start with malicious code. It starts with a maintainer account, usually via an npm token lifted from an infostealer log. By the time bad code is visible in a tarball, the worm has already run. Maintainer compromise is the leading indicator.

Send a list of package names, or a package.json or package-lock.json. Each package is resolved to the accounts able to publish it, those accounts are screened against the infostealer corpus, and findings come back at the dependency level. Maintainer identities are never returned, logged or stored: you do not need to know who someone is in order to pin a version and require review, and naming an uninvolved third party is not something we will do.

Stealer-log recency is the alert signal. A ten-year-old breach record on a maintainer's address says nothing about whether their laptop is compromised today, so those are reported as MEDIUM context rather than as an incident.

Capped at 100 packages and 150 maintainer accounts per call. If you exceed either, truncated is true and the packages beyond the cap were not checked.

Included at no per-call charge in the Agentic Attack Surface bundle ($299/mo, through AWS Marketplace or directly). The per-call price applies only outside the bundle. Screening 400 maintainers costs us about what screening 4 does, so metering it inside the bundle would invent friction and recover nothing.

Billing. $0.50 per successful call. Failed calls are never billed. Charged against prepaid credits when the balance covers it, otherwise metered to your card. Threat Intelligence subscribers and AWS Marketplace bundle customers call this at no extra charge.