The window between an attack and its signature.

Two versions come down from npm or PyPI, the diff is computed and filtered to source files, and a metadata pass surfaces dependency changes, install hooks and maintainer changes alongside it.

The unit of analysis is what changed between two releases the maintainer published. That is the shape a supply-chain compromise actually takes: not a bad package appearing, but a good one moving.

Claude scores each dimension from 0 to 10 and the aggregator turns them into a composite from 0 to 100 with a severity bucket. The weights are fixed and published rather than tuned per run, so two scans are comparable.

Network calls, obfuscation and resource exhaustion carry 20% each; install hooks and environment conditionals 15% each; dependency changes 10%.

OSV.dev, Sigstore Rekor, OpenSSF Scorecard and new-dependency provenance are queried in parallel with the model pass rather than gating it.

A package with no advisory against it still gets a semantic read, which is the only way to see the release that has not been reported yet.

Reports now carry per-stage timings and a caveats list, and the caveats are built from the diff summary alone, never from model text. Alongside them sit diff-visibility fields recording which files were truncated, skipped or split.

--strip-comments removes comments before the model sees the diff and never strips a line it cannot verify is a comment. --split-large-files sends an oversized diff in consecutive parts instead of cutting it off at the token budget. Both are off by default, so the existing corpus numbers keep their meaning.