/01
Supply chain security · 2026
Crateward
Watches crates.io, analyzes every new version statically, builds the risky ones in offline Firecracker microVMs with eBPF tracing and honeytokens, and scores each with reasons that link to the evidence. Every version also gets a CycloneDX SBOM after BSI TR-03183-2, with the findings as VEX.
Stack
RustFirecrackereBPFYARA-XPostgresCycloneDXClaude Code
Proof
Live on every new crates.io version, with over 150,000 analyzed so far. It caught the malicious crate monica_rand_core and published the finding. Each sandbox resets to a clean snapshot in about 65 ms.