Loading SOVA...
Loading SOVA...
SOVA's signal detection targets supply chain attacks — malicious code introduced via third-party packages rather than direct compromise of your codebase.
SOVA flags patterns in manifest and lock files that are statistically associated with malicious packages:
Any script that runs during npm install, pip install, or similar is a red flag. Legitimate packages almost never need install-time execution. Malicious packages use postinstall hooks to phone home, download payloads, or exfiltrate secrets.
Compiling native extensions requires elevated trust. It can bypass sandbox restrictions and introduce memory-unsafe code paths that are difficult to audit.
Base64-encoded strings, hex-encoded payloads, or eval-based patterns inside package.json scripts are strongly indicative of intentional concealment.
Tokens, API keys, or passwords in manifest or config files are exfiltrated by install-time hooks and are accessible to every developer who installs the package.
Package names that match private/internal naming conventions on the public registry may indicate a dependency confusion attack.
SOVA's detectors are tuned for low false-positive rates, but some patterns are legitimately present in valid packages:
install-scriptBuild tools (e.g. esbuild, node-sass), native addons (bcrypt, canvas), and platform detection scripts commonly use postinstall. If the package is a well-known, widely-adopted tool, the signal is likely a false positive.
native-codeCrypto libraries, image processors, and database drivers often compile native extensions. Accept if the package is well-maintained and widely used.
dependency-confusionInternal-sounding package names that are deliberately published to public registries as scoped packages (e.g. @myorg/auth) are safe. Unscoped internal names are higher risk.
suspicious-metadataPrivate packages, internal tooling, and prototypes often lack descriptions or repository links. Use context to judge.
SOVA does not:
For full vulnerability analysis, upload the SOVA manifest to securenexus.ai.