Open source · eBPF · Apache-2.0
Know which dependency did it.
The kernel can tell you a process read a secret or connected to a new host. Goodman tells you which npm package, and which version, did it, and alerts the moment a dependency does something it has never done before.
Runs on your cluster · Helm install in minutes · detection-first, no agents in your code
$ goodmanctl alerts tail
CRITICAL dependency behavior drift
service · demo-workload
package · good-pkg 1.0.0 → 1.0.1
+ NEW READ /run/secrets/credentials
+ NEW CONNECT 127.0.0.1:9999
baseline learned over live traffic · 0 prior anomalies
→ attributed to good-pkg in <3s. the package.json diff had no suspicious strings.
Trusted by developers deploying to
0
suspicious strings in the package.json diff; the version bump looked routine
0
to attribute the drift to the exact package once it misbehaved
0
Helm command to start watching a namespace, no code changes, no sidecars
The pattern behind the 2026 npm supply-chain attacks (TanStack, Axios, Shai-Hulud): install-time checks stayed green while runtime behavior changed.
54-second demo
From syscall to package name
Watch Goodman learn a baseline, catch a poisoned version reading credentials, and name the exact package, live in the dashboard.
What it catches
Built for dependency behavior drift
Scanners judge what a package might do. Goodman watches what it actually does in your production workloads.
Secret & credential reads
A package version that starts reading tokens, SSH keys, .npmrc, or cloud credentials it never touched before.
New outbound connections
A dependency that suddenly talks to cloud metadata (169.254.169.254) or an exfil host that isn't in its baseline.
Unexpected process execution
A package update that adds execve where the learned baseline had none: the classic install-script backdoor.
Any behavioral drift
Every new canonical behavior is diffed against the per-(service, package, version) baseline and scored by risk rules.
How it works
Kernel truth, package-level answers
One privileged sensor per node, one collector, one dashboard. Attribution is conservative by design: Goodman reports <unknown> rather than guess a package name.
01
Capture
CO-RE eBPF hooks open, connect, and execve on watched Node processes and records the user-space stack. No code changes, no sidecars.
02
Attribute
Stack addresses resolve through V8 perf maps to the deepest node_modules frame, mapped to its exact package.json version.
03
Fingerprint
Events canonicalize into stable behaviors like READ node_modules/pkg/** or CONNECT 169.254.169.254:80, learned per service, package, and version.
04
Diff & alert
Live behavior is compared to the learned baseline. New behavior plus a high-risk rule match becomes an alert that names the package.
Where it sits
Complementary to your scanner, not a replacement
Supply-chain defense is layered. Goodman is the runtime layer that keeps working after everything upstream said the package was fine.
Before install
Registry & SCA scanners
Judge packages by static analysis and metadata before they land in your lockfile. Necessary, but the TanStack versions passed.
At build time
CI/CD hardening
Pin dependencies, restrict egress in builds, delay upgrades. Closes the install window, doing nothing once poisoned code is running.
At runtime
Goodman
Watches what dependencies actually do in production and attributes every anomaly to a package@version. The layer the 2026 attacks proved was missing.
Open source
Apache-2.0. Runs on your cluster.
The sensor, collector, dashboard, and Helm chart are all open. Your syscall data never leaves your infrastructure. SQLite for a laptop, Postgres for production, Prometheus metrics and an SSE stream built in.
Try it locally - no root needed
git clone https://github.com/hi-heisenbug/goodman cd goodman && make demo
Install on Kubernetes
scripts/install-k8s.sh --cluster prod scripts/enable-node-attribution.sh -n checkout --all
FAQ
Common questions
- Goodman is an open-source runtime dependency-security sensor. It uses eBPF to capture security-relevant Linux syscalls, attributes each one to the exact npm package and version that caused it, learns a behavioral baseline per service, package, and version, and alerts when a dependency starts doing something it has never done before.
Get Started
Secure your software supply chain at runtime
Deploy Goodman across your infrastructure in minutes. Establish automated runtime behavior baselines, map system calls back to packages, and prevent zero-day package attacks before they can execute malicious code.
Trusted by security teams at scale
Not ready to talk? Get the supply-chain research and release notes.