Package Publisher Intelligence API

The pain is real and acute when it hits — malicious packages can compromise entire CI/CD pipelines and production systems. The Reddit thread with 190 upvotes about active malicious publishing campaigns shows genuine developer frustration. However, most developers never personally encounter a supply chain attack, so the pain is concentrated among security teams and large organizations. Pain is episodic (spikes after incidents) rather than constant daily friction. Security teams at mid-to-large companies feel this most; solo devs and small teams rarely think about it proactively.

The broader supply chain security market is huge ($2-3B+), but a pure publisher reputation API is a narrow niche within it. Realistic TAM: ~10,000-50,000 companies actively running SCA tools that would consume an additional API signal at $500-5,000/year = $5M-$250M addressable market. The high end requires registry-level integration deals (npm, PyPI themselves), which are extremely hard to land. Most of the big market dollars flow to full-platform solutions, not point APIs. You are selling a feature, not a platform — that caps your ceiling unless you expand scope.

Security teams at enterprises absolutely pay for supply chain security — Snyk, Socket, and Phylum prove this. But they pay for platforms, not individual API signals. $99/month for CI integration is reasonable but competes against free alternatives (Trusty, OpenSSF Scorecard, npm audit). Enterprise deals ($5K-50K/year) are possible but require sales effort and SOC2/compliance. The free tier creates awareness but conversion to paid is uncertain. Key risk: the big SCA platforms could add publisher scoring as a checkbox feature, eliminating the willingness to pay for a standalone product.

A solo dev can absolutely build an MVP in 4-8 weeks. The core data is publicly available: npm/PyPI registry APIs expose account creation dates, package lists, publishing timestamps, and package metadata. Building a scoring model on top (account age, publishing velocity, naming pattern analysis, code similarity hashing) is well within reach with Python/Node. A browser extension is a known quantity. The harder technical challenges (real-time scanning of all new packages, maintaining threat intel feeds, code similarity to known malware) can wait for post-MVP. Start with batch lookups on demand, not real-time scanning.

There IS a genuine gap — nobody sells a dedicated, API-first publisher reputation score as a commercial product. Trusty is closest but is free, basic, and part of a broader play. Phylum bundles author risk but doesn't sell it standalone. However, the gap exists partly because incumbent platforms could easily add this as a feature. Socket already scans all new packages — adding publisher scoring is a natural extension. The xz Utils attack narrative is compelling but cuts both ways: it shows the need but also that sophisticated attackers game reputation over years, making scoring extremely hard. Your moat is thin: the data is public, the signals are known, and well-funded competitors are a product decision away from your territory.

Strong recurring potential. Security scanning is inherently continuous — you need fresh scores as new packages are published daily. CI/CD integration means automatic lookups on every build. Threat landscape constantly evolves, requiring updated models. Enterprise security budgets are annual/recurring by nature. The 100-lookup free tier creates natural upgrade pressure as teams grow. API consumption naturally scales with customer growth (more repos = more lookups). This is a textbook subscription/usage-based business.