Over the last nine months, I've been working on a tool named #malcontent to detect when #malware is inserted into open-source software. While it is far from finished, we released v1.4.0 today, and it's the first release I am genuinely proud of: https://github.com/chainguard-dev/malcontent/releases/tag/v1.4.0

Here's a view of the new UI, shown inspecting the most recent supply-chain attack in the Lottie video player library. Each line prefixed with "+++" is a new, unexpected behavior that it detected.