{
  "id": 7376373,
  "title": "Hi DEV, I'm Rob building OSPulse at Fortitude Omnis",
  "url": "https://urgent.news/2026/09/14/hi-dev-im-rob-building-ospulse-at-fortitude-omnis",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-14T18:56:55.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/fortitudeomnis/hi-dev-im-rob-building-ospulse-at-fortitude-omnis-2p33"
  },
  "original_language": "en",
  "account": "Hello, my name is Rob. I am the creator of OSPulse, a product developed by Fortitude Omnis Group Ltd. This small indie company is challenging the large VC-funded supply-chain security companies like Snyk, Sonatype, and Socket. Unlike those competitors, we operate without external funding and without a sales team. The entire pitch for our product is contained within the product page.\n\nOur unique selling point is that most dependency tools wait for a Common Vulnerabilities and Exposures (CVE) before addressing an issue. We focus on detecting problems even before a CVE exists. For instance, packages can change hands, an npm account can be hijacked, or a maintainer might quit without warning. Examples of this include event-stream, ua-parser-js, polyfill.io, and xz, which showed signs of potential issues weeks or even months before a CVE was assigned.\n\nOSPulse evaluates project health, maintainer turnover, drops in commit velocity, and ownership changes rather than just the length of a vulnerability list. It has the capability to ingest more than ten feeds, and I am transparent about the detections it might miss as well as the ones it successfully catches. One of the most significant developments in our research and development is PoisonBox. Every time an npm install occurs, it is handled in its own disposable microVM, providing hardware-level isolation. The microVM is booted, performs its malicious actions, and is then deleted, ensuring that nothing it does affects your machine or your keys.\n\nUnderpinning PoisonBox is an eBPF probe in the kernel. This probe logs every process that is spawned, every file that is opened, every secret that is read, and every outbound connection that is established. It does this from below the code level, where the package itself cannot hide. This data is then used to draw a causal thread, tracing the events from the moment a package reads your npm token to the connection that carries it off. This trace is crucial in proving exactly what happened and in what order, especially for malicious packages. Our challenge lies in capturing the exact sequence of events. A key insight from our experience is that a confession, or honesty, is often the only thing that sets a security tool apart from its marketing. Recently, we discovered an instance where our checkout showed a price of £249 a month, while Stripe was quietly set to take £2,988 in a single hit. This discrepancy was never reflected in the transaction journey, and it appeared nowhere in the website. We resolved this issue before any customer made a payment, allowing us to share this as a success story rather than a refund.",
  "summary": "Hello all. I'm Rob. I build OSPulse at Fortitude Omnis Group Ltd, a small indie company taking on the VC-funded supply-chain names (Snyk, Sonatype, Socket) with no funding and no sales team. The product page is the whole pitch. What it does: most dependency tools wait for a CVE. I care about the window before one exists, where a package changes hands, an npm account gets hijacked, or a maintainer…",
  "key_points": [
    "Rob is the creator of OSPulse at Fortitude Omnis Group Ltd.",
    "OSPulse detects security issues before CVEs, monitoring project health and maintainer changes.",
    "PoisonBox technology isolates npm installs in disposable microVMs for hardware-level security."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}