Detect malicious activity in your Github Action workflows
Detect malicious activity in your Github Action workflows
listen.dev integrates with your CI and monitors every build for anomalous and malicious behavior. Elevate your DevSecOps and prevent supply chain attacks like Solarwinds, CodeCov and XZ-Utils.
listen.dev integrates with your CI and monitors every build for anomalous and malicious behavior. Elevate your DevSecOps and prevent supply chain attacks like Solarwinds, CodeCov and XZ-Utils.
Detect malicious activity in your Github Action workflows
Integrate in minutes
Integrate in minutes
steps:
- uses: listendev/action
with:
jwt: LSTN_API_KEY
ci: true
pytorch/pytorch-test
Update model weights
ba5f55f
13:09
build.created
webhook.triggered
13:09
build.created
Step:actions/checkout@v3
Process
Domain
Status
git-remote-http
github.com
accessing
pypi.org
python3
accessing
curl
accessing
Alert
Step:Update dependencies
e134.pipedream.net
webhook.triggered
Add a single step to your GitHub Actions workflow file, and start listening...
Add a single step to your GitHub Actions workflow file, and start listening...
listen.dev integrates with your CI and monitors every build for anomalies and malicious behavior in 3rd party components. Elevate your DevSecOps and prevent supply chain attacks like Solarwinds, CodeCov and XZ-Utils.
listen.dev integrates with your CI and monitors every build for anomalies and malicious behavior in 3rd party components. Elevate your DevSecOps and prevent supply chain attacks like Solarwinds, CodeCov and XZ-Utils.
Integrate in minutes.
Add a single step to your GitHub Actions workflow file, and start listening...
Add a single step to your GitHub Actions workflow file, and start listening...
steps:
- uses: listendev/action
with:
jwt: LSTN_API_KEY
ci: true
pytorch/pytorch-test
Update model weights
ba5f55f
13:09
build.created
Step:
actions/checkout@v3
Process
Domain
Status
git-remote-http
accessing
api.github.com
TCP
via
Step:
Update dependencies
Alert
curl
e134.pipedream.net
accessing
TCP
TCP
python3
pypi.org
accessing
via
via
webhook.triggered
13:09
Supply chain attacks are on the rise.
Scanning known vulnerabilities isn't enough.
Supply chain attacks are rising.
Scanning known vulnerabilities isn't enough.
Attackers are injecting malware in open source dependencies, base images, and 3rd-party tools to compromise development pipelines, leading to security breaches in production apps & infrastructure. It's critical to catch these threats early.
event-stream: Bitcoin-stealing malware in npm package
Malicious npm package event-stream downloaded 8 million times in the past 2.5 months raises supply chain security alarm
Compromised build environment results in SolarWinds breach
Described as the ‘most sophisticated attack’ by Microsoft, the breach impacts F500 and governments globally.
Popular testing tool exfiltrates sensitive credentials
A malicious bash uploader script undetected for 2 months steals credentials from customers.
Supply chain attacks are rising.
Scanning known vulnerabilities isn't enough.
Supply chain attacks are rising.
Scanning known vulnerabilities isn't enough.
Scanning for known CVEs isn't enough.
Attackers are embedding malware in open source packages, base images, and third-party tools to compromise CI/CD processes, leading to major security breaches in production apps & infrastructure. Mitigating these risks pre-production is critical.
Attackers are embedding malware in open source packages, base images, and third-party tools to compromise CI/CD processes, leading to major security breaches in production apps & infrastructure. Mitigating these risks pre-production is critical.
Malicious npm package event-stream downloaded 8 million times in the past 2.5 months raises supply chain security alarm
event-stream: Bitcoin-stealing malware in npm package
Popular testing tool exfiltrates sensitive credentials
A malicious bash uploader script undetected for 2 months steals credentials from customers.
Compromised build environment results in SolarWinds breach
Described as the ‘most sophisticated attack’ by Microsoft, the breach impacts F500 and governments globally.
You can't secure what you can't see
Detect & prevent supply chain attacks in CI
Exfiltration
Tampering
Malicious packages
3rd party actions
Exfiltration
Tampering
Compromise
"There are a lot of tools that process security advisory data, but listen.dev is the first I've seen that goes a step further, applying behavioral analysis to find issues before they get reported to an advisory database. This is the kind of thing we'd always wanted to do at npm, Inc., but never got around to. It's super exciting to see it come to fruition."
Isaac Z.Schlueter
Creator of npm,
Former Node.js project lead
See the unseen
Gain visibility. Assert Control.
Proactive monitoring. Comprehensive coverage. High fidelity alerts – inside your favorite tools.
You can't secure what you can't see
Prevent supply chain attacks.
Stay ahead of malware and emerging threats in 3rd party components.
Stay ahead of malware and emerging threats in 3rd party components.
Exfiltration
Tampering
Upstream takeovers
Upstream takeovers
CDN attacks
Backdoors
Malicious PRs
Pipeline posioning
Malicious packages
Test suites
Base Images
Pre-built binaries
3rd-party CI tools
Proactive Monitoring. Comprehensive Coverage. Inside your existing workflow.
"There are a lot of tools that process security advisory data, but listen.dev is the first I've seen that goes a step further, applying behavioral analysis to find issues before they get reported to an advisory database.
This is the kind of thing we'd always wanted to do at npm, Inc., but never got around to. It's super exciting to see it come to fruition."
Isaac Z.Schlueter
npm creator
"There are a lot of tools that process security advisory data, but listen.dev is the first I've seen that goes a step further, applying behavioral analysis to find issues before they get reported to an advisory database. This is the kind of thing we'd always wanted to do at npm, Inc., but never got around to. It's super exciting to see it come to fruition."
Isaac Z.Schlueter
Creator of npm,
Former Node.js project lead