Threat Analysis
Catch malicious packages before they run.
PexLens inspects code, install behaviour and publishing history on every package your developers pull — flagging malware, hidden payloads and supply-chain tampering with the evidence behind each verdict.
Request a Demo- Behavioural detection — Beyond static CVE lookups
- Evidence attached — Every flag is explainable with raw source logs
- Fleet-wide protection — Covering every developer device and CI project
The Problem
Malicious code does not announce itself.
Attackers publish packages that install cleanly, pass version checks and carry familiar names. The damage happens at install time, inside a transitive dependency, or in a version published hours ago — long before a vulnerability database catches up.
01
Trusted names, hostile code
Typosquats, hijacked maintainer accounts and impersonated forks reach developers through the same registries as everything else.
02
Damage at install time
Lifecycle scripts run before a single line of application code executes — reading credentials, phoning home, dropping payloads.
03
Signatures arrive too late
Novel attacks have no advisory on day one. Detection has to read behaviour and code, not wait for a published identifier.
04
Vulnerable, not malicious
A package may contain no malicious code at all, yet still expose vulnerable code that attackers can exploit to compromise the application.
Threat Coverage
What PexLens detects
01
Malicious code
Backdoors, troppers, miners and remote-execution logic identified inside published source.
02
Suspicious install behaviour
Lifecycle scripts that touch the filesystem, spawn shells or reach the network during installation.
03
Impersonation and typosquats
Names, scopes and metadata engineered to resemble packages your teams already trust.
04
Data exfiltration
Access to environment variables, tokens, SSH keys and wallet files paired with outbound calls.
How It Works
From package to verdict in five stages
1
Capture
Every package request across enrolled devices, projects and registries is captured in real time.
2
Inspect
Source, manifests and lifecycle scripts are analysed for malicious logic and hidden payloads.
3
Correlate
Findings are joined with advisories, publisher history and dependency context to establish intent.
4
Classify
Each threat receives a severity, a score and a written reason a reviewer can act on.
5
Enforce
Policy decides what proceeds: allow, warn, quarantine or block the request outright.
Severity and Triage
Severity that maps to an action
Scores are grouped into four bands, and each band carries a default response teams can adjust by policy.
Critical
85–100
Block the request and alert the owning team.
High
70–84
Quarantine pending review of the evidence.
Medium
40–69
Warn the developer and log for triage.
Low
1–39
Record for visibility, no interruption.
Assess Risk
Understand the real security risk of every package.
Prioritize Fixes
Focus on what matters based on impact and evidence.
Enforce Policy
Apply policies with intelligence and block risky packages.
Drive Continuous Security
Continuously monitor changes and stay ahead of risks.
Malicious code doesn't announce itself. This does.
Detect malicious behaviour and supply-chain threats before they reach production.