Hi DEV, I'm Rob building OSPulse at Fortitude Omnis

Hello, my name is Rob. I am the creator of OSPulse, a product developed by Fortitude Omnis Group Ltd. This small indie company is challenging the large VC-funded supply-chain security companies like Snyk, Sonatype, and Socket. Unlike those competitors, we operate without external funding and without a sales team. The entire pitch for our product is contained within the product page.

Our unique selling point is that most dependency tools wait for a Common Vulnerabilities and Exposures (CVE) before addressing an issue. We focus on detecting problems even before a CVE exists. For instance, packages can change hands, an npm account can be hijacked, or a maintainer might quit without warning. Examples of this include event-stream, ua-parser-js, polyfill.io, and xz, which showed signs of potential issues weeks or even months before a CVE was assigned.

OSPulse evaluates project health, maintainer turnover, drops in commit velocity, and ownership changes rather than just the length of a vulnerability list. It has the capability to ingest more than ten feeds, and I am transparent about the detections it might miss as well as the ones it successfully catches. One of the most significant developments in our research and development is PoisonBox.

Every time an npm install occurs, it is handled in its own disposable microVM, providing hardware-level isolation. The microVM is booted, performs its malicious actions, and is then deleted, ensuring that nothing it does affects your machine or your keys.

Underpinning PoisonBox is an eBPF probe in the kernel. This probe logs every process that is spawned, every file that is opened, every secret that is read, and every outbound connection that is established. It does this from below the code level, where the package itself cannot hide. This data is then used to draw a causal thread, tracing the events from the moment a package reads your npm token to the connection that carries it off.

This trace is crucial in proving exactly what happened and in what order, especially for malicious packages. Our challenge lies in capturing the exact sequence of events. A key insight from our experience is that a confession, or honesty, is often the only thing that sets a security tool apart from its marketing. Recently, we discovered an instance where our checkout showed a price of £249 a month, while Stripe was quietly set to take £2,988 in a single hit.

This discrepancy was never reflected in the transaction journey, and it appeared nowhere in the website. We resolved this issue before any customer made a payment, allowing us to share this as a success story rather than a refund.