Scan · Score · Gate
Every version earns a verdict.
Before any package reaches your tree — hosted with us or proxied from npm — it goes through owner verification, static analysis, and an AI read of its suspicious surface. The output is one number and one status you can gate on.
The pipeline
Six stages between a release and your tree.
- 01
Publish / proxy
A version arrives — published to us, or pulled from npm through the proxy.
- 02
Owner verify
Publisher identity, provenance signatures, repo linkage, ownership changes.
- 03
Static scan
Install scripts, obfuscation, typosquats, suspicious APIs, binary blobs.
- 04
AI scan
An LLM reads the suspicious surface and the diff against the last version.
- 05
Verdict 0–100
One score, one status: pass, warn, flagged, or malicious.
- 06
Your tree
Your workspace policy decides — allow, warn, or block — before install.
Static analysis
The rules that catch the classics.
Install scripts
preinstall/postinstall hooks are the classic exfiltration vector — every one is extracted and inspected.
Obfuscation
Packed, encoded, or minified-beyond-reason source in a package that should not need it.
Suspicious APIs
Child processes, raw sockets, env harvesting, and crypto-wallet patterns where they do not belong.
Typosquats
Names one keystroke away from packages with millions of downloads.
Dependency confusion
Public packages shadowing private scope names to hijack internal builds.
Binary blobs
Opaque compiled payloads shipped where source is expected.
The verdict
Start at 100. Lose points for every signal.
Critical static findings, low-confidence provenance, repo mismatches, and suspicious ownership changes each subtract from the score. High-confidence AI findings for malware, exfiltration, or backdoors skip the math entirely — the version is marked malicious.
| Score | Status | What happens |
|---|---|---|
| 80–100 | pass | Installs normally. |
| 50–79 | warn | Installs; the decision is recorded and surfaced. |
| 0–49 | flagged | Blocked under the default policy. |
| hard triggers | malicious | Always blocked, in every policy mode. |
Your call
Policy decides what a verdict means.
Gating is per workspace. Malicious versions are blocked no matter what.
warn_only
Everything installs; warnings and decisions are recorded for review.
block_flagged
The default. Flagged and malicious versions are blocked; unscanned versions install while a scan fires asynchronously.
block_flagged_and_unscanned
The strict mode: nothing unscanned gets in. Installs wait for a verdict.
Anatomy of a block
What a stopped attack looks like.
npm prints the verdict body — your terminal tells you exactly why the install never happened.
Get started