Caligula: Software Supply Chain Security Scanner

Caligula: Software Supply Chain Security Scanner

Modern software is mostly other people's code — npm packages, pip wheels, Maven JARs, base images, AMIs. Caligula, now open source and integrated into the Praetorian Guard Platform, scans your supply chain for known vulnerabilities, malicious packages, typosquats, hidden binaries, obfuscated payloads, and unpatched cloud images — across 7 ecosystems and 12 manifest formats, with zero API keys required.

What Caligula Does For You

Caligula runs four scanning modules against your source repositories and AWS images, returning enriched, gateable findings ready for CI:

  • Dependency vulnerability scanning — discovers manifest files, extracts every declared dependency, and queries OSV.dev for known CVEs. Findings are enriched with CVSS base score, EPSS exploitation probability, CISA KEV flag, and the earliest fixed version.

  • Malicious package detection — eight detection passes including known-malware advisories, typosquatting (homoglyph, combosquat, edit-distance), repository integrity mismatch, compromised maintainer-domain takeover, hidden compiled binaries, code obfuscation, and malicious install-script analysis.

  • AMI vulnerability scanning — extracts the installed RPM package list directly from an Amazon Machine Image via the AWS API. No need to launch the AMI or hand-roll rpm -qa output. Matched against the Amazon Linux Advisory (ALAS) feed and enriched with EPSS and KEV.

  • Infrastructure-as-Code scanning — discovers AMI references inside Terraform, CloudFormation, Packer, and plan JSON, peels each AMI, and reports CVEs tagged with the exact file and line of IaC that introduced the vulnerable image.

Coverage That Matches Real Codebases

Caligula understands the manifests your engineers actually commit:

npm (package-lock.json v1/v2/v3, package.json), Yarn (v1 + Berry), pnpm (v5 + v6), pip (requirements.txt), Pipenv (Pipfile, Pipfile.lock), pyproject (PEP 621 + Poetry, poetry.lock, uv.lock), Go modules (go.mod with go.sum verification against sum.golang.org), Maven (pom.xml), Gradle (build.gradle, .kts, libs.versions.toml), NuGet (.csproj, packages.lock.json), RubyGems (Gemfile.lock), Composer (composer.lock), and Amazon Linux RPM (rpm-qa manifests or peeled directly from an AMI).

Enrichment That Tells You What to Fix First

Every vulnerability finding carries the context CI gates need to make a sharp triage decision:

  • CVSS base score and severity — computed from the v2/v3/v4 vector, including the full FIRST.org MacroVector interpolation for CVSS v4.

  • EPSS score and percentile — the FIRST.org probability the CVE is exploited in the next 30 days.

  • CISA KEV flag — whether the CVE appears in the Known Exploited Vulnerabilities catalog.

  • Earliest fixed version — so the upgrade decision is one read away.

  • Lockfile and version-range integrity — flags missing lockfiles, orphaned lockfiles, node_modules/ without a committed lockfile, and overly permissive version ranges (*, latest, unbounded >=) that defeat reproducible builds.

  • Checksum verification — verifies go.sum against sum.golang.org, requirements.txt --hash entries against PyPI, and package-lock.json SRI integrity against the npm registry. Detects checksum-bypass environment variables (GOSUMDB=off, GOFLAGS=-insecure) hiding in .envrc, Dockerfiles, and CI workflows.

Eight-Pass Malicious Package Detection

Beyond known CVEs, Caligula hunts for active supply-chain attacks:

Known malware via OSV.dev MAL-* advisories plus a Praetorian-curated feed for attacks not yet indexed upstream. Typosquatting with three sub-passes — homoglyph normalization (rn→m, 0→o), combosquat suffix stripping (-js, -cli, node-), and Levenshtein edit distance — all routed through a metadata gate that escalates confidence on packages younger than 7 days or missing README/license, and suppresses legitimate variants that share maintainers with the popular target. Repository integrity mismatch, compromised maintainer domain via RDAP, compiled binaries hidden in node_modules/ or vendor/, code obfuscation (eval-with-encoded-args, base64+zlib+exec chains, hex-XOR loops), and install-script analysis (npm lifecycle hooks piping curl-to-shell, Python setup.py with encoded execution, __init__.py credential exfiltration).

AMI Scanning Without Launching the AMI

Cloud images have always been a blind spot. Caligula peels Amazon Machine Images directly through the AWS EBS Direct API — downloads only the snapshot blocks it needs, parses the partition table and ext4/XFS filesystem in pure Go, reads the RPM database, and matches packages against the ALAS feed.

No instance launch. No SSH. No rpm -qa handoff from a customer. Caligula classifies every AMI it touches and surfaces operational coverage gaps as typed findings — Marketplace AMIs, instance-store images, KMS-denied snapshots, oversized volumes, deregistered AMIs — so a clean report is genuinely clean and a peel failure is never silent.

IaC Scanning That Points to the Line

Caligula discovers AMI references in your Terraform, CloudFormation, Packer, and plan JSON, peels each one, and emits CVE findings stamped with the exact source file and line that introduced the vulnerable image. A KEV-tagged finding goes from "your fleet has a problem" to "edit terraform/baseline/main.tf:47" in one click.

Static-mode parsing handles literals, variables, mappings, and parameter defaults — about 70% of real-world coverage with zero AWS calls. Opt into --resolve-dynamic to live-resolve data "aws_ami" blocks, SSM parameters, and Packer source filters via the AWS SDK for the remaining 30%.

CI-Ready Output

Caligula writes whichever format your pipeline consumes:

  • Table to stdout — color-coded severity for human review.

  • SARIF 2.1.0 for GitHub Code Scanning — findings appear inline on pull requests.

  • JSON — every field, including ignored findings preserved for audit.

  • HTML — self-contained interactive report with severity filter, full-text search, and sortable columns.

  • CycloneDX v1.6 SBOM — every scanned package as a component with its purl, every finding as a vulnerability with CVSS rating and upgrade recommendation.

Exit code 0 means clean, 1 means findings, and a --kev-only-gate flag lets you fail builds only on actively-exploited CVEs.

Policy That Lives With Your Code

A .caligula.yaml file in the repository tunes scan behavior with versioned, auditable rules: ignore an accepted CVE with a mandatory reason and expiry date, allowlist a legitimate "typosquat" (e.g. flask-login for flask), set a minimum severity threshold, skip IaC paths, or pin kev_only_gate: true for production branches. Suppressed findings are preserved in JSON output for compliance review but excluded from exit codes and SARIF.

Zero API Keys, Free Forever

Every data source Caligula reads is free and public — OSV.dev, Amazon Linux ALAS, FIRST.org EPSS, CISA KEV, sum.golang.org, the npm and PyPI registries, IANA RDAP, and GitHub's REST API. There are no usage tiers, no rate-limited trial keys, and no vendor lock-in. Cached responses live in ~/.caligula/cache/ with sensible TTLs so repeat scans complete in milliseconds.

Native to Guard — Zero Setup Required

Caligula runs natively inside the Praetorian Guard Platform, scanning every repository and AWS image Guard has access to. The more integrations you connect — source code managers, AWS accounts, Image Builder pipelines — the more ground Caligula covers. Findings surface alongside your other risks, fully integrated into your existing remediation workflows. No new tools to learn. No separate dashboards. If you're a Guard customer, Caligula is already working for you.

Open Source — Inspect Every Check, Contribute Your Own

Caligula is fully open source at github.com/praetorian-inc/caligula. Inspect every detection rule, audit the AMI peel pipeline, contribute a custom advisory for an attack OSV hasn't indexed yet. The same code Praetorian's offensive operators run during engagements is the code that runs inside Guard — and the code you can run yourself today.

Get Started

Guard Platform customers already have Caligula working for them. To run it standalone:

git clone https://github.com/praetorian-inc/caligulacd caligulago build -o caligula ../caligula /path/to/your/repo

Or to gate a CI pipeline on actively-exploited CVEs only:

./caligula --mod deps --kev-only-gate --formats sarif /path/to/repo

Reach out to your Praetorian engagement team to discuss how Caligula-powered supply chain scanning fits into your security program.