← All work
Open-source tool · 2026
Forged
An open-source developer tool that scans a project's dependencies for malware and hijacked releases.
The problem
Software supply-chain attacks hide in brand-new package versions and quiet publisher changes. Developers needed a one-command check that explains what it found instead of dumping raw data.
What I built
- Checks every dependency against known-malware reports
- Flags versions published in the last 72 hours and unexpected publisher changes
- Catches look-alike package names and suspicious install scripts
- Every release is signed and traceable to the exact commit that built it
Where it is now
Published on npm as forged-cli, with over a thousand downloads.
Next project
WebReport Pro →