1.1M records
- NVD827K CVEs
- OSV.dev210K records
- GitHub GHSA73K advisories
- JVN · MSRC · Red Hat · WPVulnDBlive
- EPSSabsorbed
Refreshed daily via Cloud Run jobs. Dedup'd, semver-normalized, indexed for sub-100ms lookup.
CyberXYZ began as peer-reviewed research at Cork (CIT → MTU). This is the methodology behind the verdict: six detection signals, a cross-signal scorer, and the data that feeds them, across Java, JavaScript, Python, Go and .NET.
The brain reasons over 1.1 million vulnerability records, 14,000+ malware advisories and 6.6 million dependency edges, refreshed continuously from the public feeds and our own proprietary intel: behavioral baselines, maintainer drift, and 16 hand-curated attack campaigns mapped to MITRE ATT&CK.
Vulnerability data is fragmented across dozens of feeds: different schemas, different IDs, different update cadences. We ingest them all, normalize into one unified schema, deduplicate, and build a live dependency graph with 6.6 million edges.
Refreshed daily via Cloud Run jobs. Dedup'd, semver-normalized, indexed for sub-100ms lookup.
Coverage across npm, PyPI, Maven, NuGet. Synced after every OSV pull. The corpus CVSS doesn't see.
Built in-house. Updated continuously. The reason we catch axios@1.14.1 in 18 seconds and not 6 days.
NVD
GHSA
OSV
MSRC
ExploitDB
MITRE ATT&CK
FIRST / EPSS
Red Hat
Java
npm
PyPI
Maven
NuGet
Go
Cargo
RubyGems
Composer
DockerNVDGHSAOSVMSRCExploitDBMITRE ATT&CKFIRST / EPSSRed HatJavanpmPyPIMavenNuGetGoCargoRubyGemsComposerDockerEvery package and every commit is evaluated against six independent signals. A cross-signal scorer fuses them into a single decision: allow, alert, quarantine or block.
We don't replace CVSS or EPSS. We absorb them, then add the four things they're missing: package centrality, behavioral drift, malware intel, and exploit availability. The result is a score you can act on.
axios@1.14.1, the day the maintainer was compromised.
CVSS shrugged. EPSS hadn't caught up. XYZ blocked it.
The classic 0–10 base score. We keep it, but we never trust it alone.
The 30-day exploitation forecast. Folded in as an exploit-likelihood input, not the verdict.
Monthly downloads, dependent count, GitHub stars, tier (1–4). A vuln in a Tier-1 package is 1000× more dangerous than the same vuln in a leaf.
Maintainer-set change, file-count drift > 30%, install-script appearance, ≥3-minor version jump. Catches compromise before any CVE is filed.
14,000+ MAL-* records (OSV MAL + 9 human-verified) + 16 attack campaigns mapped to MITRE ATT&CK TTPs. The corpus CVSS doesn't see.
ExploitDB + Packet Storm + GitHub PoCs cross-referenced. If it's weaponized, the score knows.
A vulnerability in a Tier-1 package, one that millions of dependent packages pull in transitively, is a thousand times more dangerous than the same vulnerability in a leaf. We rank every package on the registry by downloads, dependent count, GitHub stars and graph centrality, and we feed that into every decision the brain makes.