The extension,
every command and setting.

Install

Install CyberXYZ Supply Chain Scanner from the Visual Studio Marketplace, or search for it in the Extensions view (Ctrl+Shift+X, Cmd+Shift+X on macOS). From a terminal:

code --install-extension cyberxyz.cyberxyz-vulnerability-scanner

VS Code 1.80 or newer. Run CyberXYZ: Get Started from the Command Palette for a four-step walkthrough: sign in, open a project, review the issues, Fix All.

Sign in

Run CyberXYZ: Sign In. VS Code shows a one-time code and opens the CyberXYZ dashboard. Check the code matches and approve with your usual sign-in: password and MFA, SSO, or a passkey. There is no key to copy. No account yet? Create one at app.cyberxyz.io.

• The session is stored in VS Code's secret storage (your OS keychain), never in settings.json.
• It lasts 90 days without use. Every scan extends it. You can revoke it from the dashboard at any time; it is named after the machine's hostname.
• CyberXYZ: Sign Out revokes the session on the server and forgets it locally.
• For a shared build machine, CyberXYZ: Set API Key stores an sk_xyz_ key in the same secret storage.

Until you sign in, dependency trees are read locally and no package is checked.

Supported ecosystems

Each package in each tree, direct and transitive, is checked at the version the lockfile installs. Lockfiles are parsed on your machine; only package names and versions are sent.

Limits to know about

• Maven and Gradle are not parsed by the extension (nor Cargo, RubyGems or Composer). A single Maven package can be checked with the CLI: xyz check PACKAGE VERSION -e maven.
• Without a lockfile, the tree comes from the CyberXYZ registry graph, which follows each package's latest release, so it is marked Approximate. CyberXYZ: Generate Lockfile gives exact versions.
• Pipfile.lock and go.sum record versions but not who requires whom, so indirect packages are listed flat.
• Dependencies with no version (requests alone, *, git URLs) are not checked, because every advisory would match.
• Virtual workspaces (a repository opened in the browser) are not supported: the extension reads the local file system.

Where to find it

The CyberXYZ shield in the Activity Bar holds three views:

• 01
  Dependenciesevery manifest with its package, issue and KEV counts, then its direct dependencies, then the full tree. Only Packages with Issues keeps just the paths that lead to a problem.
• 02
  Issuesevery package version with something to act on, worst first. Known-malicious and blocked releases come first, then actively exploited (CISA KEV) advisories, then the rest by severity. Each entry shows the fix version and every path that pulls it in.
• 03
  Fix Historyevery fix applied from this machine.

In the manifest itself you get diagnostics on the dependency line, a hover card, CodeLens and quick fixes. Hovering an import in JavaScript, TypeScript, Python or Go shows the same package card, from the last scan and with no network call. The status bar (CyberXYZ: 3 issues (1 KEV)) opens the Issues view.

Direct and flagged packages also get the CyberXYZ proxy decision (block, quarantine, alert) and its reason in words: "Published very recently", "New dependency injected in this release". These are lookups: the platform does not record them as installs in your organization's proxy log.

How fixing works

For each flagged package, CyberXYZ's per-version data gives the nearest version free of the advisories that affect the one you have, preferring one within your current major version. When that data holds no clean release, the fix is the highest fixed version across the package's advisories. A version that leaves one of the advisories open is never offered as the fix.

Fix one finding

Use the light bulb on the dependency line (Ctrl+., Cmd+.), the CodeLens above it, or Fix in either view. The quick fix says what it fixes, for example Upgrade pkg 1.2.3 → 1.2.9 (fixes 3 advisories, 1 KEV). The version is rewritten the way it was written (^1.2.3 becomes ^1.2.9, ==2.0.1 becomes ==2.3.3).

Fix All

The wrench in the Issues and Dependencies toolbars, CyberXYZ: Fix All, or right-click a manifest for just that file. It plans a fix for every finding, then shows one confirmation: every change grouped by file, the advisories it clears and the command that follows. Major-version bumps, removals, alternatives and partial fixes are unticked: nothing crosses a major version unless you tick it. The ticked changes are applied, then each manifest's lock command runs once. The confirmation and the summary group the findings: 12 fixable now / 3 partially fixable / 2 no upstream fix.

No fixed version upstream

From 0.5.1: when no release fixes an advisory yet, Fix on the finding, the no complete fix, see the options quick fix, and Options for N unfixed after Fix All offer what you can do instead:

• Upgrade to X (clears N of M), marked PARTIAL, when a newer version fixes some of the advisories. Fix History records it as an upgrade, with the advisories still open in its reasons.
• Remove the dependency (direct dependencies). The extension looks for imports of it in the JavaScript, TypeScript, Python or Go files next to the manifest and says looks unused or where it is imported. Removal always asks to confirm. For a transitive package, Show what pulls it in.
• Ignore with a reason and expiry, pre-filled with the advisory and no fix available upstream, expiring in 30 days so the finding comes back for a re-check.
• Open the advisory (GitHub, NVD or OSV) and the package's page on packages.cyberxyz.io.

A finding flagged only by a proxy signal (a new maintainer, a version jump, no advisory) has nothing to upgrade to; it is counted separately. There is no "replace with" option: CyberXYZ has no data on maintained alternatives, so it does not suggest one.

Lockfile regeneration

The extension edits manifests, never lockfiles. After a fix it runs the lock command (npm install, uv lock, poetry lock, go mod tidy, dotnet restore, ...) as a visible task in the manifest's folder and records its exit code. When the lockfile changes, the tree is read again and re-checked. A manifest without a lockfile gets Generate lockfiles, then plan first.

One-click tool install

If the tool a command needs is missing, the extension uses a fallback when there is one (uv pip compile, corepack yarn, python3 -m pip). Otherwise it offers one Install button with the best installer on the machine: uv tool install, pipx, Homebrew, winget, scoop, apt, corepack enable or npm install -g. The install runs as a visible task, is recorded in Fix History, and the fix continues when it finishes. Nothing is installed without your click.

Fix history

Every fix (single, quick fix, Fix All, tool install) is recorded with the time, workspace, file, package, versions, the advisories it cleared and the lock command's result. The history stays on this machine (the last 1,000, not synced). Export Fix History (JSON) saves it to a file. With xyz-scanner.reportFixes on, fixes are also reported to your organization in the background.

Fix requests from your organization

An organization admin can click Request fix on an open finding in the dashboard. While you are signed in, the extension checks for requests when it starts and every 15 minutes, and shows a notification with Review & apply and Decline.

The developer always confirms. A request names only a package and two versions. Review & apply plans the change locally, from your own manifest and lockfile, and opens the Fix All confirmation with it ticked. No command, script or edit from the server is ever run. If the local plan disagrees (a major-version jump, the package is no longer in the workspace, no fixed version is known), you see why and the request is declined with that reason. Turn requests off with xyz-scanner.acceptFixRequests.

Ignoring findings

Ignore… asks what to ignore (one advisory, this version, or every version), why, and an optional expiry date. It writes .cyberxyz/ignore.json at the workspace root with your git name; commit it so your team shares the decision.

{
  "version": 1,
  "ignores": [
    { "package": "lodash", "ecosystem": "npm", "version": "4.17.20",
      "advisory": "CVE-2021-23337", "reason": "not reachable: we never call template()",
      "expires": "2026-12-31" }
  ]
}

Ignoring a blocked or known-malicious package needs a second confirmation. A malicious package should be removed, not ignored.

Your organization's fleet

Right-click a package in either view:

• 01
  Machines in My Org That Installed Thisfrom the proxy and agent install log (last 90 days).
• 02
  Proxy Decisions for This Packageyour organization's install log for it.
• 03
  Blast Radiuspublic packages that depend on it, and whether their ranges admit the affected version.
• 04
  Open in CyberXYZ Dashboardthe package page, its dependency graph, the proxy monitor or environments.

What your organization sees

While you are signed in, the extension reports to your CyberXYZ organization. Each of these can be turned off in settings.

Lookups from the extension identify themselves as editor lookups, so they are never counted as installs in your organization's proxy log.

Commands

From the Command Palette (Ctrl+Shift+P, Cmd+Shift+P). The last seven appear only on the views' toolbars and right-click menus, or the status bar. This table is generated from the extension's package.json.

Settings

Open Settings and search for CyberXYZ. apiUrl and dashboardUrl are machine settings: a workspace cannot override them, so a cloned repository cannot redirect your credential.

Privacy

The extension sends CyberXYZ only what it needs to check your dependencies, and only while you are signed in. The full list of requests, with every field, is in PRIVACY.md, shipped inside the extension.

Never sent: source code, file contents (lockfiles are parsed locally), absolute file paths, .env files or secrets, your ignore file, your settings, or telemetry. Turn uploads off with xyz-scanner.uploadScans, xyz-scanner.reportFixes and xyz-scanner.acceptFixRequests. To stop all network calls, sign out and remove any API key.

Troubleshooting

CI and the command line

The extension checks what you have open. To gate every pull request on the same verdicts, add the CyberXYZSecurity/depalert-action@v1 GitHub Action or the gitlab.com/cyberxyz/depalert GitLab CI/CD component: the CI/CD gate guide has the templates, thresholds and exit codes. For the terminal, the xyz CLI gives the same verdicts, routes installs on the machine through the CyberXYZ proxy, and covers what the extension does not parse: single Maven packages with xyz check PACKAGE VERSION -e maven, installed IDE and browser extensions, and system packages.

Support and security

• 01
  MarketplaceCyberXYZ Supply Chain Scanner
• 02
  Dashboardapp.cyberxyz.io
• 03
  Support and bug reportssupport@cyberxyz.io
• 04
  Security vulnerabilitiessecurity@cyberxyz.io (security.txt). Please report privately; we acknowledge within 72 hours.