Most security tools scan what's inside your build. Depi maps everything upstream of it: the maintainers, registries, CI pipelines, and domains that produced your dependencies, and monitors every trust relationship that could be weaponized against your stack. Every risk assessment runs from your specific context: your projects, your dependency graph, your exposure. Two companies depending on the same package get different risk pictures based on how central that package is to their stack and where it sits in their propagation path. Depi detects 35+ upstream exploit classes including dependency confusion, package takeover, expired email domain attacks, GitHub Actions PWN Requests, TOCTOU vulnerabilities, and cache poisoning, across npm, PyPI, Bundler, Cargo, and GitHub Actions. Depi continuously re-evaluates every node in the graph as the upstream changes. Not a point-in-time snapshot. A trust map that moves with your stack.