Supply-Chain Security for Startups Without a Budget

A startup ships fast, and shipping fast means pulling in other people's code. Packages, base images, and third-party actions are the fuel. They are also the attack surface. Supply-chain attacks work because they hit you through something you already trust, and small teams feel it hardest: fewer eyes, more borrowed code, tighter deadlines.

You do not need a procurement cycle to defend this. Here is the threat, then a free checklist built on open-source tools and community intel.

Where the attacks come from

• Typosquats and dependency confusion. A package named one character off a real one, or a public package that shadows your private one, slips into an install.
• Malicious install hooks. A postinstall script that fetches and runs a payload, or dumps environment variables and sends them off.
• Poisoned container images. A base image on a public registry with a cryptominer or a reverse shell baked into a layer.
• Compromised repositories and actions. A GitHub repo or a CI action that looks useful and quietly exfiltrates secrets when it runs.

The free defense, layer by layer

Match a free tool to each layer of what you pull in. All of these are open source and correlate against OpenSourceMalware, a free community feed of confirmed-malicious packages, repos, and images.

• Packages and dependencies: Legion scans installed packages for known vulnerabilities and catches typosquatted or vulnerable AI SDK packages. On Windows, WRAITH adds a supply-chain module with 200-plus indicators across npm, NuGet, and AI and ML ecosystems.
• Container images: KNÖRR, on the Threat Research page, is malicious container intelligence. It statically analyzes images on Docker Hub and GHCR, and even malicious Dockerfile code on GitHub before an image is published. Nothing is ever executed.
• Repositories: Git Warden, also on the Threat Research page, discovers and confirms malicious GitHub repositories on their own static evidence, so you can check a source before you depend on it.
• The pipeline that ties it together: Legion Runner hardens the CI job that installs and builds all of the above. More on that in the GitHub Actions guide.

A checklist you can run for free

1. Pin what you depend on. Lock package versions and pin GitHub Actions to a commit SHA, not a floating tag. A pinned dependency cannot be swapped under you.
2. Scan before you add. Before a new dependency lands, check it. Legion and WRAITH will flag known-bad packages and typosquats.
3. Vet your base images. Do not pull a random public image into production. Check it with KNÖRR first.
4. Check unfamiliar repos. Before you copy code or add a repo as a source, see whether Git Warden has confirmed it malicious.
5. Harden the pipeline. Put Legion Runner in front of your CI so a poisoned dependency cannot phone home with your secrets.
6. Watch the feeds. The threat landscape moves. The community feed these tools use is refreshed continuously, so your checks stay current without any work from you.

The teams most exposed to supply-chain attacks are often the ones with the least budget to fight them. Free, open tools close that gap.