Ossprey

Ossprey is a software supply chain security platform designed to detect and remove malicious code in open source dependencies before they reach production environments. The platform targets engineering-led organizations that rely heavily on open source software and prioritize development velocity. Core capabilities include: - Static analysis and behavioral analysis techniques to identify malicious intent within open source packages - Detection of novel, previously uncatalogued threats that lack CVEs or known signatures - Integration across the software development lifecycle (SDLC), including GitHub and AI agent environments - A dashboard providing severity scoring (high, medium, low) based on assessed malicious intent rather than generic vulnerability metrics - An AI-powered analysis engine that evaluates what code is attempting to do at runtime Unlike traditional software composition analysis (SCA) tools that rely on known vulnerability databases, Ossprey focuses on behavioral detection — identifying packages that function as advertised while concealing malicious payloads. The platform is designed to operate passively alongside existing toolchains without requiring changes to developer workflows or introducing approval bottlenecks. Target users include engineering leads, CTOs, security-conscious founders, and security engineers at fast-moving companies. The product is positioned as a complement to existing security tooling rather than a replacement. The company was founded by Nate Dunning and David Read, who cite direct experience with supply chain attacks as motivation for building the product. The trust center is hosted on Vanta's EU infrastructure, suggesting a European operational presence.