depgaze: Dependency execution intelligence

The rise of software supply chain attacks (eg: Shai-Hulud campaign) and the increasing sophistication of the techniques used to poison packages, made me think about an undeniable way in which data exfiltration or malicious payload installation could be detected, without relying on what is known or traditional detection mechanisms (eg: CVE, static code analysis, LLM based detection and available heuristics models/tools) but instead, reason and act on what a simple npm install or pip install has actually done after the facts. The need for a novel approach to this problem, not only comes from a pure security perspective, but also because I think we need a stronger trust layer between the code that now gets written at light speed and the dependencies introduced and shipped together with our products.