depgaze

depgaze is a command-line developer utility for Linux and Windows, designed to secure your software supply chain. It leverages OS-level fingerprinting to audit and explain the dependencies flowing through your continuous integration pipeline and inner development loop. Key features include: • Catches malicious, abandoned, and risky packages • Supports npm and PyPI ecosystems • Integrates directly into CI/CD and developer environments • Provides plain-language verdicts and concrete fixes • Functions as a callable skill for developer agents This tool protects against the vast majority of software you ship that you didn't write or review. It runs at install time, the earliest possible point to detect and prevent supply chain attacks, by observing every package entering your project. depgaze scores each package for malice, rot, triviality, and risk in real time. It provides detailed explanations of why a dependency is flagged, along with actionable steps to mitigate risks. For example, it can identify credential theft attempts or benign utility libraries. Every decision refines its judgment, making it more effective over time. depgaze ensures that even code pulled in by your dependencies' dependencies is thoroughly vetted. Built for engineering teams and security professionals, depgaze ensures the integrity of your codebase. It can be hosted on your own infrastructure for maximum privacy and integrates seamlessly into existing developer workflows. This ensures protection where developers work, providing critical insights without slowing down development cycles.