HookAudit: Building a Supply-Chain Security Scanner Without a Supply Chain

Description and use

HookAudit is a repository configuration auditor built with zero third‑party dependencies to eliminate attack surface and nondeterminism, demonstrating that native Node.js APIs can replace common npm packages.

Problem

Security scanners that audit untrusted repositories risk inheriting attack surface and nondeterminism from their own third‑party dependencies, and may trigger target project lifecycle scripts before analysis.

Outcome

HookAudit achieved a zero‑dependency security scanner that eliminates attack surface from its own code, provides deterministic analysis, and demonstrates that native Node.js APIs can replace common npm packages without sacrificing functionality.

Workflow

• Discover all configured execution surfaces in the repository
• Detect commands, flags, and execution parameters
• Trace multi‑hop references from configuration files to secondary scripts
• Infer reachable capabilities (network, process, credentials) along the execution path
• Establish an integrity baseline and detect semantic drift across pulls

Evidence

We were building a tool whose express purpose was to audit project configuration files for supply‑chain compromises. And our very first architectural gesture was to pull in a tree of third‑party packages—the same class of supply‑chain risk we intended to audit.

Source

By stripping away external packages, we removed third‑party runtime dependencies from the scanner itself. But we also threw away the abstractions that modern JavaScript developers take for granted every day.

Source