Phi

• 

  logo

Inspiration

Modern software development relies heavily on third-party dependencies and package ecosystems, making software supply chains a primary target for malicious attacks. Software packages often execute arbitrary scripts during installation, creating a dangerous attack vector. We built Phi to establish an intelligent, r eal-time defense layer that intercepts potential threats right at the point of installation, before any malicious code can execute on a developer's machine or CI/CD pipeline.

What it does

Phi is an install-time security interception tool built for software supply chains, alongside phi watch, a public, always-on monitoring servi ce. Key capabilities include:

• Install-Time Interception: Intercepts package installation commands in real time to inspect setup scripts and sub-dependencies before they execute.
• Multi-Ecosystem Coverage: Scans npm packages, Go modules, and public GitHub repositories through one unified CLI (phi view, phi install, phi audit).
• Threat & Malicious Code Detection: A static-analysis engine parses source with a real JS AST (not just regex) to flag dynamic code execution, credential theft, obfuscat ion, and other malicious patterns, cross-referenced against OSV/GitHub Advisory Database for known CVEs and confirmed-malicious packages.
• Continuous Monitoring: phi watch polls tracked packages around the clock, re-checking advisories on every cycle so a vulnerabili ty disclosed after a package was scanned still surfaces — with full scan history per package, so you can inspect exactly what changed and when.
• Policy Enforcement: Allows teams to set clear compliance rules, automatically blocking non-compliant or high-risk packages from running.
• Seamless CLI Integration: Integrates into existing developer workflows and build systems without requiring drastic shifts in toolchains.

How we built it

• Backend & System Interception: Built using Golang for high-performance system execution, concurrent package analysis, and minimal runtime overhead.
• Security & Analysis Engine: A goja-based JS AST walker detects malicious patterns with byte-offset-accurate evidence, layered with heuristics that parse package install ation lifecycle scripts and evaluate risk signatures before execution — tuned against a running false-positive regression corpus of real, widely-used packages to keep detecti ons precise.
• Advisory Integration: Queries OSV (which aggregates the GitHub Advisory Database) per-ecosystem for npm and Go modules, merging confirmed-malicious and CVE data into th e same risk score the static analyzer produces.
• Public Monitoring Service: phi watch (Go + Postgres) continuously scans a public feed of packages, exposing a live dashboard, per-package scan history, and a JSON API.

Challenges we faced

• Low-Latency Interception: Ensuring that intercepting and analyzing packages at install time introduces minimal delay, preserving a fast developer experience.
• Minimizing False Positives: Balancing strict security policies with common, legitimate build script behaviors so developer productivity isn't disrupted — we built a ded icated false-positive regression suite, run nightly, to catch any detector change that silently re-flags a package we already know is safe (or, just as important, one that si lently stops catching a package we know is malicious).
• Staying Current, Not Just Accurate: A scan taken today can go stale the moment a new advisory is published tomorrow. We had to make sure phi watch re-checks advisory da ta on every poll cycle instead of trusting a cached verdict forever, so a newly-disclosed vulnerability against an already-scanned package doesn't sit unflagged.

Accomplishments that we're proud of

• Building a lightweight, fast interceptor in Go that processes security checks in milliseconds.
• Successfully preventing untrusted install-time scripts from executing unauthorized system commands during package setup.
• Extending phi's ecosystem coverage from npm-only to npm, Go modules, and GitHub repositories, both in the CLI and in phi watch's live monitoring.
• Shipping full per-package scan history on phi watch, so a package's verdict isn't just a single snapshot — you can click into any past scan and see exactly what it flagged, at any version, at any point in time.
• Closing a subtle but real gap where a package's advisory data could go stale after its first scan — phi watch now re-checks OSV/GHSA every cycle, so newly-disclosed vulnera bilities against already-scanned packages surface without waiting for a code change to trigger a rescan.

What we learned

• Install-time hooks are one of the most under-protected surfaces in open-source security; protecting this step significantly closes supply chain vulnerabilities.
• Security tools must be frictionless — if interception adds noticeable lag to package installs, developers will bypass it.
• A vulnerability database is a moving target, not a fixed snapshot — a monitoring system that treats "scanned once" as "safe forever" will eventually miss something real.

What's next for Phi

• Expanded Ecosystem Support: Extending interception support to PyPI, Cargo, and other major language package managers.
• CI/CD Native Plugins: Releasing native integrations for GitHub Actions, GitLab CI, and Docker build environments.
• AI-Powered Anomaly Detection: Incorporating real-time behavioral analysis models to catch zero-day supply chain attacks based on installer behavior.

Built With

• golang