OPEN SOURCE SECURITY

Not every open-source package
deserves your trust.

PexLens identifies malicious, suspicious and vulnerable open-source components — and states the signals behind each verdict, so an engineer can check the reasoning instead of taking a score on faith.
Request a Demo
  • Three verdict classes — malicious, suspicious, vulnerable
  • Signals, not scores alone — every verdict is explained
  • Judged per version — not per package name

THREE CLASSES, THREE RESPONSES

"Vulnerable" and "malicious"
are not the same problem.

A vulnerable component is honest code with a known flaw. A malicious one was published to do harm. Treating both as a single number is why security backlogs stall — so PexLens separates them, and says which it found.
MALICIOUS

Published to do harm

Credential theft, hidden payloads, typosquatted names, install-time execution. There is no safe version to upgrade to — the package itself is the attack.
Response: remove it and find everywhere it reached.
SUSPICIOUS

Not proven, not clean

Abrupt maintainer changes, unexplained behaviour shifts, obfuscated code, releases that do not match their repository. Enough to warrant a look before it spreads.
Response: remove it and find everywhere it reached.
VULNERABLE

Known flaw, known fix

Most organizations cannot say which packages or extensions are on which developer machine today.A published CVE affects the version in use. The finding carries the identifier, the severity and the release that resolves it where one exists.
Response: remove it and find everywhere it reached.
WHAT WE LOOK AT

Nine signals behind every verdict

No single signal decides anything. A verdict is the pattern across all three groups.
GROUP 01 · THE CODE
Install-time execution
Scripts that run before any code is imported
Credential and key access
Read of token, cloud and SSH paths a library has no reason to touch
Obfuscation and payloads
Encoded blobs, dynamic evaluation, code that unpacks itself at runtime
GROUP 02 · THE PUBLISHER
Maintainer change
Ownership handed over, then a release soon after.
Release irregularity
A dormant package publishing again, or versions arriving out of pattern.
Source mismatch
Published artifact does not correspond to the public repository it claims.
GROUP 03 · THE IDENTITY
Name similarity
Typosquats and near-misses on widely used package names.
Known advisories
CVE and advisory data matched against the exact version resolved.
Reach and adoption
Analyze download velocity trends, dependent chains, and historical reputation of critical code modules.

VERSION-LEVEL TRUTH

The package is fine. The version is not.

Most open-source risk arrives in a single release of an otherwise reputable package. A verdict attached to a package name is useless; PexLens judges the exact version resolved, and tells you which release is clean.
Findings are pinned to the version in use, not the latest published
Where a fixed release exists, the finding names it
A cleared version stays cleared — the judgement is not re-litigated per team
IN THE CONSOLE

Every flagged component, with its reason

Package, version, registry, severity, score and the reason it was flagged — the same verdict language used everywhere else in PexLens.
Filter by severity
Sort by score

What we cover

The Ecosystems we judge

START WITH AN INVENTORY

Make every package request a security decisions.

Pexlens helps you secure open source at every step of the supply chain.