Data Points

📚 Software Package

🔗 Analyst pivots

🔍 Lookup

📜 Playbook — Software Package exploitation

1. Direction — frame the requirement for Software Package: what decision does this support, by when?
2. Collection — pull the 0 mapped sources (0 free) and the native workbench; capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

✨ Enrichment pathways

🎫 Software Package

A software package is a named, versioned distributable unit published to a language registry (npm, PyPI, RubyGems, Maven, crates.io, NuGet, Go modules) and consumed as a dependency. It matters in investigations because it is the primary vector for supply-chain attacks: typosquats, dependency confusion, hijacked maintainer accounts, and malicious install-time scripts.

Format: Package URL (purl) form pkg:<type>/<namespace>/<name>@<version>; registry-native forms e.g. npm '@scope/name@1.2.3', PyPI 'name==1.2.3', Maven 'group:artifact:version'; versions typically SemVer (MAJOR.MINOR.PATCH)

📡 How it is collected

• SBOM (CycloneDX/SPDX) ingestion
• Manifest/lockfile parsing (package.json, requirements.txt, go.sum, Cargo.lock)
• Registry metadata API pulls
• CI/CD build and install logs
• Endpoint/EDR install telemetry
• Container image layer inspection

📚 Enrichment & validation sources

🔗 Pivot to

🧩 Analysis & hunting techniques

• Typosquat / edit-distance neighbor detection
• Dependency-confusion (internal vs public name) checks
• Install-script (postinstall/preinstall) static analysis
• Version-to-version code diffing
• Maintainer-takeover / new-publisher anomaly detection
• Entropy and obfuscation scoring
• SBOM diffing against known-good baseline
• Provenance / SLSA attestation verification

🔧 Tools

• OSV-Scanner
• Socket CLI
• Syft
• Grype
• Semgrep
• guarddog
• npq
• OWASP Dependency-Track

⚡ Workbench actions

• Fetch registry metadata
• Scan install scripts
• Diff versions
• Query OSV advisories
• Compute canonical purl
• Screen maintainer identity
• Generate SBOM
• Detect typosquat neighbors

📊 Dashboard KPIs

📂 Open