Provenyx Security

Sign in with GitHub

Provenyx brings software supply-chain investigation into your editor — analyzing your npm lockfile without installing or executing a single package.

Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦

Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦

Provenyx follows every package in your lockfile, direct and transitive, without running a line of it. Explainable rules over public npm metadata surface unusual releases. Blockchain-anchored manifest hashes show whether a release record matches what was published. Every finding shows its reasoning.

Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦

Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦

Safe by design

0

Packages installed or executed

100%

Transitive dependencies mapped

3

Independent evidence layers

Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦

Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦

Explainable
Detection

Every flag shows the rule that fired and the metadata behind it. No black-box scores — just evidence you can check yourself.

Dependency Mapping

See exactly how every package reaches your project from package-lock.json.

Release Anomalies

Explainable rules flag release behavior worth a closer look.

Release Verification

Compare metadata with blockchain-anchored manifest hashes.

Editor Native

Scan and investigate from the VS Code extension.

Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦

Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦

Architecture

Three layers. Zero installs.

Your lockfile is sent only after you confirm each scan. A missing on-chain record is an evidence gap, not proof of compromise — and a matching hash confirms a record's integrity, not that a package is safe.

Layer 1Map

Layer 2Detect

Layer 3Verify

Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦

Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦Trust every dependency✦Verify every release✦Zero installs✦Explainable rules✦Blockchain-anchored records✦npm lockfile scanning✦