EU-based · open-source maintenance as a subscription

Your open-source stack, maintained and compliant — by agents, supervised by humans.

No account needed for the summary.

acme/checkout — dependency tree (depth 3 of 11)

checkout@2.4.0
├── express@4.18.2            CVE-2024-29041   reachable
│   └── body-parser@1.20.1    last release 2023-09
│       └── qs@6.11.0         maintainer: 1 unpaid
├── next@14.1.0
│   └── postcss@8.4.31        patched 2023-10
└── @acme/pdf@1.9.3
    └── node-forge@1.3.1      3 open advisories

The problem

Your security posture is decided by packages nobody is paid to maintain.

You reviewed your own code. You did not review qs, pulled in by body-parser, pulled in by express — three levels down, one unpaid maintainer, and in your production request path. From 11 December 2027 that package is part of the product you place on the EU market, and the due diligence on it is yours.

Transitive by default

A typical Node service resolves ~1,200 packages from ~40 direct dependencies. You chose 40 of them.

Unfunded by default

The maintainer of a package in your request path is usually one person, unpaid, with no release schedule.

Now legally yours

CRA Art. 13 due diligence on integrated components sits with the manufacturer — the company shipping the product, not the package author.

Recent npm supply-chain attacks

June 2026
June 2026
Lumma stealer via npm typosquats
Over 300 npm packages with names mimicking popular libraries silently installed the Lumma information-stealer on developer machines and CI runners.
Socket report →
March 2026
March 2026
tj-actions/changed-files compromise
A GitHub Actions workflow used by thousands of repositories was backdoored, leaking CI secrets — tokens, keys and passwords — across public and private repositories in a single wave.
Socket report →
November 2025
November 2025
Shai-Hulud "Second Coming"
A self-replicating npm worm returned at larger scale: Socket tracked well over 500 compromised packages in a single wave, stealing developer and CI credentials and republishing itself from the accounts it took over.
Socket report →
September 2025
September 2025
chalk / debug maintainer phishing
A phishing email to one maintainer led to malicious releases of chalk, debug and other tiny utilities that together account for billions of weekly downloads — crypto-stealing code shipped straight into installs.
Socket report →
September 2025
September 2025
Shai-Hulud, first wave
Starting from @ctrl/tinycolor, the worm spread through maintainer tokens across ~180+ packages, exfiltrating secrets and pushing them to public repositories.
Socket report →

How it works

Two phases: a human makes the repo agent-safe, then agents maintain it.

The order matters. Agents are only trustworthy on a repo that can prove a change is correct. Phase 1 builds that proof surface once; Phase 2 uses it every day.

Phase 1 · human-managed · one-off

Enrolment

An engineer maps the dependency graph, fixes the build, raises test coverage on the paths that matter, and wires SBOM generation and advisory monitoring into CI.

Dependency and licence inventory
Reproducible build and pinned toolchain
Coverage on security-relevant paths
SBOM in CI, advisories wired to the lockfile
Escalation policy agreed in writing

Typically 2–4 weeks per repository.

Phase 2 · agent-managed · subscription

Maintenance

Agents run continuously against the proof surface Phase 1 built. Humans handle escalations.

Dependency updates with call-site migration
Advisory monitoring and reachability triage
PRs with tests, changelog and SBOM diff attached
Monthly maintenance report you can hand to an auditor
Escalation to a named human maintainer within SLA

Runs from day 1 after handoff.

What the agents actually do

Concrete tasks, run continuously, each producing an artefact you can check.

Dependency updates

Read the upstream changelog, bump the version, migrate call sites, fix the tests that break.

Security analysis

Scan each release, diff advisories against the lockfile, check the fix landed.

API migration

Follow language and library API changes and rewrite affected code, not just the version string.

Test-coverage maintenance

Add tests for uncovered paths touched by an update; block merges that lower coverage.

Release notes

Write the changelog entry from the diff, with the CVE identifiers and breaking changes named.

SBOM generation

Generate and attach a standards-based SBOM to every release.

CVE triage and reachability

Decide whether an advisory is reachable from your code before it becomes a ticket.

Upstream contribution

Send the fix upstream first, so you stop carrying the patch.

Compliance

Three EU regulations turn “is your stack maintained?” into a legal question.

We state what the texts say and name the source. This is not legal advice.

Cyber Resilience Act

Reg. (EU) 2024/2847

11 Sep 2026 reporting · 11 Dec 2027 full

Products with digital elements: secure-by-design, SBOM, conformity assessment, CE marking. The dependency tree is in scope, and the CRA defines an “open-source software steward” role.

NIS2

Dir. (EU) 2022/2555, Art. 21(2)

National transposition ongoing

Essential and important entities must manage supply-chain security and secure acquisition, development and maintenance, including vulnerability handling and disclosure.

DORA

Reg. (EU) 2022/2554

Applies since 17 Jan 2025

Financial entities: ICT third-party risk management and a register of information covering contractual arrangements for ICT services.

Until full CRA obligations — 11 December 2027

—

Vulnerability and incident reporting duties start earlier, on 11 September 2026.

OS-Agents is not a law firm. Nothing on this site is legal advice. Every regulation reference names the instrument and the article or date so you can check it against EUR-Lex yourself.

Pricing

Simple, transparent pricing — one enrolment fee, then a monthly subscription.

Single repo

€350 / month

One repository. First month is a one-time enrolment fee of €500.

Continuous dependency maintenance
CVE triage with reachability
SBOM on every release
Same-week escalation

Request a free check

Product

€1,400 / month

Up to 5 repositories. First month is a one-time enrolment fee of €2,000.

Everything in Single repo
API migration work included
Monthly maintenance report for audit
4-hour escalation, business hours