DRYDOCK

Full-Hull Repository Auditor for the Defense Industrial Base Security 360, LLC DBA NEATLABS™ · Category: Su (Supply Chain) Powered by the MANIFEST (dependency exposure) and GANTRY (pipeline security) engines.

Pull the whole vessel out of the water. Drop a lockfile, a workflow, an SBOM — or your entire repository as a zip — and get one repository verdict mapped to the NIST SP 800-171 practices a CMMC assessor will ask about.

The three modes

DRYDOCK routes automatically based on what you drop:

1. Dependency manifest (15 formats: package-lock.json, yarn classic/berry, pnpm, requirements.txt, poetry, Pipfile, go.sum/go.mod, composer, Gemfile, Cargo, NuGet, CycloneDX/SPDX SBOM) → MANIFEST engine: three detection layers — a bundled offline index of the full OpenSSF malicious-packages corpus (228,000+ packages, no network required), a curated seed IOC set with campaign narratives, and live OSV.dev lookup (CVEs with computed CVSS scores) — plus typosquat, install-script, provenance, and pinning heuristics.

2. GitHub Actions workflow (or composite action.yml) → GANTRY engine: compromised-action IOCs (tj-actions · CVE-2025-30066/KEV, reviewdog cascade), pwn-request detection, script injection across 17 attacker-controlled contexts, token scope, hardcoded credentials, self-hosted runner exposure, secrets-to-untrusted, mutable pinning, curl|bash, and a CM.L2-3.4.1-ready action inventory. Fully offline.

3. Repository zip → both engines, every lockfile and every workflow found automatically (node_modules/vendor/.git skipped), producing one combined verdict, e.g.:

   REPOSITORY EXPOSURE — 4 MALICIOUS PACKAGES · 1 COMPROMISED ACTION · 1 EXPOSED CREDENTIAL

Every finding carries implicated CMMC 2.0 Level 2 practices, an assessor-perspective note, and a POA&M starting point. One-click standalone HTML evidence report covering both sides of the build.

Run it

Windows: double-click run.bat (or python app.py). macOS / Linux: ./run.sh (or python3 app.py).

App opens at http://127.0.0.1:8470. Try samples/demo-repo.zip for the full combined-verdict experience.

Security & privacy

DRYDOCK is local-only by design (binds to 127.0.0.1) with DNS-rebinding protection, security headers, zip decompression limits, output encoding on all user-influenced values, and bounded regex surfaces. The UI makes zero external requests — no CDNs, fonts, analytics, or telemetry. Full details: SECURITY.md and PRIVACY.md. Python 3.10+.

The repository's own CI workflow is SHA-pinned, least-privilege, and audits itself with the GANTRY engine on every push — this tool eats its own cooking.

Architecture doctrine

• Zero-Custody: everything is parsed in memory per request; nothing is written, logged, or transmitted. Online mode (optional, dependency engine only) transmits package name/version tuples — never file contents. With online mode off, DRYDOCK makes zero network calls and is fully air-gap capable.
• Compliance by Design: output is structured as objective evidence (RA.L2-3.11.2 scanning, CM.L2-3.4.1 inventory) with POA&M seeds.
• Human-in-the-Loop: heuristic findings are verification tasks; every IOC entry carries a public reference.

Maintenance

• Refresh the malicious-package corpus: python3 tools/sync_malicious.py (~300 MB download, run monthly).
• Add local IOCs: engines/manifest/data/ioc_local.json (packages) and engines/gantry/data/ioc_local.json (actions). No entry without a public reference.
• Control mappings are data (engines/*/data/cmmc_map.json), so framework updates (800-171 r3 migration) are a data change, not a code change.

Tests

pip install -r requirements-dev.txt && pytest -q   # 27 tests incl. hardening regression suite

Engine internals carry their own suites in the standalone MANIFEST (32) and GANTRY (27) repositories. The UI is verified with a jsdom harness covering combined-mode rendering and HTML-escaping of hostile finding content.

Honest limitations

• Dependency scanning sees declared dependencies; pipeline scanning sees workflow configuration, not runtime behavior of referenced actions.
• The offline corpus is a snapshot; online mode adds CVEs and advisories newer than the compile date.
• GitHub Actions only for pipeline checks in this release.
• This is a screening tool that produces evidence — it is not an assessment and does not claim compliance.