840K+ records
- NVD827K CVEs
- OSV.dev210K records
- GitHub GHSA73K advisories
- JVN · MSRC · Red Hat · WPVulnDBlive
- EPSSabsorbed
Refreshed daily via Cloud Run jobs. Dedup'd, semver-normalized and indexed.
CyberXYZ began as MSc research defended at Cork (CIT → MTU). This is the methodology behind the verdict: the detection signals, a cross-signal scorer, and the data that feeds them, across Java, JavaScript, Python, Go and .NET.
The brain reasons over 840,000+ vulnerability records, 240,000+ known malicious packages and 11 million dependency edges, refreshed continuously from the public feeds and our own proprietary intel: behavioral baselines, maintainer drift, and 32 confirmed attack campaigns tracked across every package they touched.
Vulnerability data is fragmented across dozens of feeds: different schemas, different IDs, different update cadences. We ingest them all, normalize into one unified schema, deduplicate, and build a live dependency graph with more than 11 million edges.
Refreshed daily via Cloud Run jobs. Dedup'd, semver-normalized and indexed.
Coverage across npm, PyPI, Maven, NuGet. Synced after every OSV pull. The corpus CVSS doesn't see.
Built in-house. Updated continuously. The reason a hijacked release like axios@1.14.1 is blocked at install, not days later when an advisory lands.
// top row: where the data comes from · bottom row: ecosystems in the data
Every package version is checked against independent signals; six of them are shown here. A cross-signal scorer combines them into a single decision: allow, alert, quarantine or block.
We don't replace CVSS or EPSS. We absorb them, then add the four things they're missing: package centrality, behavioral drift, malware intel, and exploit availability. The result is a score you can act on.
NVD
GHSA
MSRC
Red Hat
axios@1.14.1, the day the maintainer was
compromised (an illustration of the model, not a recorded score). CVSS shrugs. EPSS hasn't
caught up. A score that weighs behavior and malware intel calls it a ship-blocker.
The classic 0–10 base score. We keep it, but we never trust it alone.
The 30-day exploitation forecast. Folded in as an exploit-likelihood input, not the verdict.
Monthly downloads, dependent count, GitHub stars, tier (1–4). A vuln in a Tier-1 package is 1000× more dangerous than the same vuln in a leaf.
Maintainer-set change, file-count drift > 30%, install-script appearance, ≥3-minor version jump. Catches compromise before any CVE is filed.
240,000+ known malicious packages (OSV MAL + 155 human-verified) + 55 attack campaigns mapped to MITRE ATT&CK TTPs. The corpus CVSS doesn't see.
ExploitDB + Packet Storm + GitHub PoCs cross-referenced. If it's weaponized, the score knows.
A vulnerability in a Tier-1 package, one that millions of dependent packages pull in transitively, is a thousand times more dangerous than the same vulnerability in a leaf. We rank every package on the registry by downloads, dependent count, GitHub stars and graph centrality, and we feed that into every decision the brain makes.
Book 15 minutes. We run real packages through CyberXYZ while you watch, including axios 1.14.1, a hijacked release that dropped remote-control malware in March 2026, and show you exactly what your team would see. Then we connect one laptop or one pipeline for a 30-day proof of value.
Check any package, free, and see the verdict we would give it.
Check your inbox. We'll reach out within 24 hours.