Book a demo →
XYZ Scanner · CLI 1.4.74

Supply-chain security, terminal-native.

Every npm, pip, Go and NuGet install goes through the CyberXYZ proxy and gets a verdict before it downloads. The same CLI audits what is already installed, scans your code and gates CI.

$pipx install cyberxyz-scanner
Get started Read the docs
npm Python / PyPI Go .NET / NuGet macOS, Linux and Windows
fig. 01 / every install, through the proxy
npm PyPI Go NuGet
// a laptop or a CI runner
npm install express@4.21.2npm · clean
proxyverdict engineregistry
✓ 200 allowed
npm install lodash@4.17.204 advisories · fix 4.18.1
proxyverdict engineregistry
! 200 allowed · alert
npm install faker@6.6.6known malicious release
proxyverdict engineregistry
✗ 403 blocked
pip install requests==2.32.5go get github.com/google/uuid@v1.6.0dotnet add package Newtonsoft.Json --version 13.0.3PyPI · cleanGo · cleanNuGet · clean
proxyverdict engineregistry
✓ 200 allowed
known-malicious releasesadvisories and KEVbehaviour signalsfail-closed if unreachable

real verdicts for every version shown; status codes as the npm proxy returns them

The problem

The install is the attack.

A malicious release runs its install script on the machine that fetched it, often before any advisory exists. A scanner that reads the lockfile afterwards reports what already ran. xyz puts the verdict in front of the install.

Mini Shai-Hulud, May 19 2026 (UTC)

time before anyone wrote it upthe attack and the disclosure
Mini Shai-Hulud, May 19 2026, UTC Publish window 01:39 to 02:06 UTC: 639 malicious versions across 323 packages. First trigger package 01:39. Second trigger package 01:44. A burst of 14 packages at 01:56. First public write-up 02:22, 43 minutes after the first malicious publish. CyberXYZ first blocked the trigger package at 08:57, after the disclosure. 01:3001:4001:5002:0002:1002:2002:30 publish window 01:39 to 02:06 639 malicious versions across 323 packages 14 packages at once first public write-up first publish 43 minutes from the first malicious publish to the first public write-up 01:44 second trigger: size-sensor@1.0.401:44 · size-sensor@1.0.4the same phantom-commit dropper 01:56 burst of 14 packages01:56 · a burst of 14 packages at oncescript-scan signal fires 02:22 first public disclosure02:22 · first public write-up43 minutes after the first publish 01:39 first trigger: jest-canvas-mock@2.5.301:39 · jest-canvas-mock@2.5.3 publishedfirst trigger: phantom-commit dropper
  1. 01:39First trigger package, jest-canvas-mock@2.5.3
  2. 01:44Second trigger package, size-sensor@1.0.4
  3. 01:56A burst of 14 packages publishes at once
  4. 02:06Publish window closes: 639 malicious versions across 323 packages
  5. 02:22First public write-up, 43 minutes after the first publish
  6. 08:57CyberXYZ first blocks jest-canvas-mock@2.5.3, after the disclosure. We were late; the case study says what we changed
fig. 02 / timestamps and counts as published in the Mini Shai-Hulud case study; per-minute publish counts are not published, so none are drawn. CyberXYZ's 08:57 block falls off the right of this chart
// npm · DPRK RAT dropper

axios@1.14.1 RAT dropper

A compromised maintainer shipped two malicious axios tags that pulled in a North Korean RAT dropper. Blocked at install by CyberXYZ since April 2026.

~100M weekly downloads174K dependent packages~3 hrs exposure window
Read the case study → // npm · worm · credential theft

Mini Shai-Hulud AntV npm worm

One stolen npm token poisoned 323 packages across the AntV namespace in 27 minutes, with a credential harvester wired to run before any user script. Blocked after the first public disclosure; the case study covers what we changed.

323 packages639 bad versions27 min window
Read the case study →

On PyPI, the Hades worm poisoned PyPI projects with a .pth startup hook. CyberXYZ sent HIGH alerts about 30 minutes after the wave began, hours before the first public advisory.

How we stop it

A firewall for installs, not a setting to forget.

sudo xyz proxy setup --system routes every package manager through the proxy and installs an agent that keeps it that way.

fig. 03 / what an admin sees while the agents work
app.cyberxyz.io/dashboard

Machine coverage

Does each machine actually send installs through the proxy? From each agent's own check-in.

Machines →
6 of 6 fully routed100%
Routed
6
Partially routed
0
Not routed
0
Silent >24h
0
Agent outdated
0
needs attention
  • dev-laptop-07not routed: npmheartbeat 14s ago
  • dev-laptop-21partially routed, not: yarnheartbeat 31s ago
  • qa-mac-04silent for 30 hoursheartbeat 1d ago
  • build-runner-02agent v1.4.66 outdatedheartbeat 9s ago

Every machine with an agent is routed and checking in.

Agent versions are compared with v1.4.69, the newest agent in your fleet.

Agent events

What changed, newest first.

  1. checked in, routedqa-mac-04 back after 30 hours; every package manager routes
    2s ago
  2. drift repaireddev-laptop-21 yarn config restored to the proxy
    14s ago
  3. install refused, fail-closedci-runner-3 express 5.1.0 could not be verified: 503, retry in a minute
    27s ago
  4. agent restarted onto 1.4.69build-runner-02 after xyz upgrade, by itself
    39s ago
  5. drift repaireddev-laptop-07 npm config restored to the proxy
    52s ago

the Machine coverage card rebuilt from the dashboard home (HomeCards.tsx); the event feed is an illustration of what the platform records: each agent's routing report and repairs, its version, and the proxy install log. Machine names are fictional.

How the agent works
Audit and fix

What is already installed, and the version to ship.

The proxy covers installs from now on. xyz audit checks everything installed before. xyz fix plans the upgrade and never edits a lockfile.

fig. 04 / xyz fix, in a project
PROBLEMSOUTPUTTERMINALPORTSzsh
~/storefront on main❯ xyz fixXYZ fix — checking 4 packages from package-lock.json, package.json… Upgrade plan: 3 flagged package(s)┏━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ ┃ Package ┃ Current ┃ Issue ┃ → Target ┃ Why ┃ ┡━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩│ faker │ 6.6.6 │ BLOCK GHSA-5w9c-rv96-fr7g; │ none │ no clean release above 6.6.6 │ │ │ │ malicious release │ │ │ ├──────────────┼─────────┼──────────────────────────────┼──────────┼───────────────────────────────┤│ jsonwebtoken │ 8.5.1 │ ALERT GHSA-8cf7-32gw-wr33, │ 9.0.0 │ nearest clean release above │ │ │ │ GHSA-27h2-hvpr-p74q │ │ 8.5.1, clears 4 advisories │ ├──────────────┼─────────┼──────────────────────────────┼──────────┼───────────────────────────────┤│ lodash │ 4.17.20 │ ALERT GHSA-r5fr-rjxr-66jc, │ 4.18.1 │ nearest clean release above │ │ │ │ GHSA-35jh-r3h4-6jhm │ │ 4.17.20, clears 4 advisories │ │ │ │ │ │ (also latest clean) │ └──────────────┴─────────┴──────────────────────────────┴──────────┴───────────────────────────────┘2 with a target, 1 without ✖ 1 flagged package(s) have no clean upgrade target.~/storefront on main❯

real output, VS Code Dark Modern terminal; --write shows a diff and asks first

fig. 05 / where xyz audit lands
app.cyberxyz.io/dashboard/xyz-scan
machine audits
NPM Audit npm macOS
3,389packages
Clean
$ xyz audit npm
ran on
dev-mbp-07
ADby a.developer·less than a minute ago

the XYZ Scan card, rebuilt from the dashboard with a real xyz audit npm upload; names changed

One command for the lot. xyz audit uploads npm, Python, every venv, Go, IDE and browser extensions and system packages as separate cards, so the dashboard can re-check them as new intelligence arrives.

Code scan

Secrets, IaC and SAST, in one report.

xyz code-scan all runs open-source engines plus CyberXYZ's own supply-chain rules. It scans only what git would commit, redacts every secret, and never calls a partial run clean.

Code scan reference
fig. 06 / xyz code-scan engines
~/storefront · zsh
$ xyz code-scan enginesENGINE STATUS VERSION USED FOR -------- -------- --------- -------------------------------gitleaks found 8.30.1 secretstrivy - iac, image (secrets fallback)opengrep - code (SAST, built-in xyz rules)bandit - code fallback (Python)gosec - code fallback (Go)checkov - iac with --engine checkov Missing: trivy, opengrep. Run `xyz code-scan engines --install` to install them.

real output; PATH and INSTALL columns trimmed

Connected to the platform

One verdict engine. Every surface. One dashboard.

The CLI, the VS Code extension, CI and AI coding agents ask the same engine, and every run lands on the same dashboard.

fig. 07 / one engine, every surface: the hub
xyz + agentevery install on laptops and serversallowed, alerted or refused at the proxy VS Codethe lockfile tree, worst firstfixes planned from the same verdicts CI/CDprotect installs, then gate the buildGitHub, GitLab, Azure DevOps AI coding agentscheck_package over MCPan install hook denies blocked packages one verdict engine app.cyberxyz.io every run lands here: audits, fix plans, scans, gates
  • xyz + agent every install on laptops and servers, allowed, alerted or refused at the proxy
  • VS Code the lockfile tree, worst first, with fixes planned from the same verdicts
  • CI/CD protect installs, then gate the build (GitHub, GitLab, Azure DevOps)
  • AI coding agents check_package over MCP; an install hook denies blocked packages
  • app.cyberxyz.io every run lands here: audits, fix plans, scans, gates

on the dashboard: machine audits, fix plans, code scans and CI gates by machine and by person; secrets triage; Scan now

What reaches the dashboard   The VS Code extension
CI/CD gate

A red build beats a shipped exploit.

Protect routes the job's own installs through the proxy, so a malicious version is refused on the runner. Scan gates on the lockfiles and exits non-zero on anything that should never ship.

fig. 08 / jobs flowing through the xyz gate
GitHub GitLab Azure DevOps
// any source
job #4821proj #1180
protectinstallxyz gate
✓ passed
job #4822proj #2043
protectinstallxyz gate
✓ passed
job #4823proj #1180
protectinstallxyz gate
✗ failed · 1 malicious
fig. 09 / what the gate returns
0allowed
1block
2quarantine
3alert
4not checked; never clean
  • uses: CyberXYZSecurity/depalert-action@v1, one line; mode: protect early, the default scan as the gate
  • The gitlab.com/cyberxyz/depalert catalog component
  • Azure and the rest: eval "$(xyz ci protect)" before installs. xyz ci init writes the pipeline file.
The CI/CD gate guide
Why CyberXYZ

Keep your scanner. Add the layer it can't be.

Different jobs on the same supply chain. Run them together.

// cve-only sca scanners

Report known advisories

  • ✓ Known CVEs and advisories in your lockfiles
  • ✓ Severity scores, fix versions, SBOMs
  • ✗ Nothing to report until an advisory exists
  • ✗ Read the tree after the install has run
// cyberxyz

Stop it at install, on laptops and CI

  • ✓ Install-time blocking for npm, pip, Go and NuGet, through an always-on, fail-closed proxy
  • ✓ Malicious releases first, with the reason in words
  • ✓ The same verdict at the CI gate, with exit codes per decision
  • ✓ Fleet visibility: agent version, routing and drift, per machine
  • ✓ Fix plans that never cross a major version silently
  • ✓ AI coding agents checked too, through MCP and an install hook
AI coding agents

The same verdict, before the agent installs.

xyz mcp install --client all gives Claude Code, Cursor, VS Code, Windsurf, Codex CLI and Gemini CLI the CyberXYZ tools. With --hooks, Claude Code is denied installs of blocked or quarantined packages.

No install? The hosted server is https://mcp.cyberxyz.io/mcp.

MCP setup
the rest of the toolbox
xyz checkThe proxy's verdict for one package version, before you add it. xyz fixThe nearest clean release per flagged package; --write shows a diff and asks. xyz impactWho depends on a package, and whether this project reaches it. xyz sbomCycloneDX 1.5 or SPDX 2.3 from your lockfiles, with advisories, EPSS and KEV. xyz audit modelsLocal model files hashed and HF references found, never unpickled. xyz remediate runRuns removals an admin approved in the dashboard.
Full command reference
Install

One package. The xyz command.

$pipx install cyberxyz-scanner

or pip install cyberxyz-scanner · later, xyz upgrade

Quick start Full reference
  1. Sign in with your browserxyz login, then approve a one-time code with your usual sign-in, MFA, SSO or passkey. The session lasts 90 days from last use.
  2. Turn on the proxysudo xyz proxy setup --system routes every package manager and installs the agent. Fleets enroll with an MDM token.
  3. Check it, any timexyz proxy status: every tool routed, the lock on, the agent current.
  4. fig. 10 / step 3, xyz proxy status
    ~ · zsh
    $ xyz proxy statusXYZ Proxy Status Machine name: dev-mbp-07 ✓ Proxy is configured for npm, pip, Go, NuGet. Always-on agent Service : system Last report : 20s ago by the system agent Agent code : 1.4.68 (matches the installed CLI) CLI session : active (kept alive by the agent)┏━━━━━━━━┳━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ ┃ Tool ┃ Status ┃ Effective registry ┃ ┡━━━━━━━━╇━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩│ npm │ … ok │ https://npm-proxy.cyberxyz.io ││ pnpm │ … ok │ https://npm-proxy.cyberxyz.io ││ yarn │ … not installed │ ││ bun │ … not installed │ ││ pip │ … ok │ https://***@pip-proxy.cyberxyz.io/sim │ │ │ │ ple/ ││ uv │ … ok │ https://***@pip-proxy.cyberxyz.io/sim │ │ │ │ ple/ ││ go │ … ok │ https://***@go-proxy.cyberxyz.io,dire │ │ │ │ ct ││ nuget │ … ok │ https://nuget-proxy.cyberxyz.io/v3/in │ │ │ │ dex.json ││ poetry │ … │ │└────────┴───────────────────┴───────────────────────────────────────┘

    real output; machine name changed; per-tool config block, Detail column and state path trimmed

  5. Then, whenever you likexyz audit for the whole machine, xyz fix in a project, xyz code-scan all before you push.
Python 3.8 or newer (3.10 for xyz mcp) · included in every plan, see pricing · Maven: single packages with xyz check PACKAGE VERSION -e maven; Maven project audits are not available yet · in the editor, use the VS Code extension
// the ask

Gate every install,
from laptop to CI.

See the CLI, the proxy and the dashboard in a 15-minute walkthrough. The CLI is included in every plan, from $25 per developer per month, with a 30-day proof of value.

  • ✓ npm · PyPI · Go · NuGet
  • ✓ In every plan, from $25/dev/month
  • ✓ 30-day proof of value
✓

Thanks! We'll be in touch.

Check your inbox. We'll reach out within 24 hours.

Get a demo

We'll respond within 24 hours. No spam, ever.