Marshal

What Marshal is

Marshal scans Maven and Gradle dependencies for behavioral signs associated with supply-chain attacks and can block risky updates at pull-request time. It monitors Maven Central for new project dependency versions, scoring each update from 0 to 100 across seven rules. Those rules look for signals such as maintainer changes, dropped signatures, dependency growth, repository changes, version jumps, and yanked versions. A GitHub Action checks pull requests, and Slack webhook alerts are available for critical findings. The open-source CLI and GitHub Action are Apache 2.0 licensed, self-hostable, and can run offline for cached packages. The CLI needs Java 21 or later; the GitHub Action includes its own runtime. Marshal supports Maven and Gradle projects, including Spring Boot, Spring, and plain JVM libraries, but not Android AGP or Kotlin Multiplatform in v1. It does not check known vulnerabilities and is intended to complement CVE scanners. Its maker says static behavioral analysis only partially detects slow, long-running social-engineering attacks. Marshal is in early development, with issue reporting directed to GitHub Issues.