Supply Chain Tampering

Gatekeeper

A published tool package is intercepted and its WASM binary is patched to exfiltrate arguments to an attacker's server. See how MPP's Gatekeeper catches the tampered binary via Ed25519 signature verification — before any tool code runs.

Step 1: Simulate the attack

Flip a byte in the WASM binary to simulate a supply chain compromise, then run the demo to see how each runtime responds.

Tamper with the binary first to start the demo.

Without MPPExecutes backdoor

Download tool from CDN URL

No integrity check performed

Tool executes immediately

With MPPRejected

Step 1Gatekeeper: open archive

Step 2Gatekeeper: parse manifest

Step 3Gatekeeper: compute SHA-256 digest

Step 4Gatekeeper: verify Ed25519 signature

Step 5Package rejected — binary was tampered