Supply Chain Threat Intelligence
Catch supply chain attacks
before they reach production.
Vekt scans 22 lockfile formats across 12 package ecosystems against real-time malicious package and vulnerability data. CLI, IDE, and browser extension.
See it in action.
Real output from scanning 221 lockfiles across a production codebase.
Three layers of
supply chain defense.
Malicious Packages
Detects confirmed malicious packages flagged with MAL-* advisories from the OSSF malicious-packages database. Credential stealers, crypto miners, backdoors.
MALICIOUS MAL-2025-21003 evil-logger@3.2.1Known Vulnerabilities
Queries OSV.dev for CVEs, GHSAs, PYSECs, and RustSec advisories across all 12 ecosystems. Real-time data, not a monthly snapshot.
VULN GHSA-xxxx-yyyy lodash@4.17.15Typosquat Detection
Flags packages whose names closely resemble popular packages. Levenshtein distance, character substitution patterns, and scope confusion detection.
TYPOSQUAT Did you mean 'requests'?One scanner.
Every surface.
CLI
Scan lockfiles from the terminal. JSON output for scripts and CI. 3.7MB binary, zero dependencies.
IDE / LSP
Yellow squiggles on vulnerable deps, red on malicious. Hover for details, quick-fix to update. Every editor via LSP.
Browser Extension
Trust badge on npm, PyPI, crates.io, and 7 more registries. See maintainers, version history, and provenance before you install.
CI/CD
Block PRs that introduce new vulnerabilities. SARIF output for GitHub Advanced Security. Exit codes for pipelines.
REST API
POST a lockfile, get findings. Per-scan pricing that no one else offers. JSON response, rate limit headers, API key auth.
Fast
69,419 packages scanned in 46 seconds. Parallel parsing, package deduplication, OSV batch API. Rust binary, not a wrapper script.
Trust data where
you evaluate packages.
See vulnerabilities, maintainer credibility, and security signals directly on npm, PyPI, crates.io, and 6 more registries. No tab switching.
Instant analysis
Trust bar appears at the bottom of every supported registry page. Green, yellow, or red -- no security expertise needed.
Maintainer credibility
Click for the full trust panel: OpenSSF score, vulnerability count, maintainer GitHub profiles with star counts, dependency depth, provenance status.
Simple settings
Toggle registries on or off. Add your API key for enriched trust scoring. Privacy-first: only sends package name and version, never browsing data.
12 ecosystems. 22 formats.
Every major package manager, parsed natively in Rust.
npm
PyPI
crates.io
Go
RubyGems
Packagist
NuGet
Pub
Swift
Hex
Hackage
CRANuv.lockrequirements.txtpoetry.lockPipfile.lockpackage-lock.jsonbun.lockyarn.lockpnpm-lock.yamlCargo.lockgo.sumGemfile.lockcomposer.lockpubspec.lockPackage.resolvedmix.lockrebar.lockpackages.lock.jsoncabal.project.freezestack.yaml.lockrenv.lockpdm.lockpixi.lockSimple pricing.
Per-scan API pricing. No seat-based licensing.
Free
50 scans per day
- All 12 ecosystems
- 22 lockfile formats
- JSON + human output
- CLI + API access
Pro
5,000 scans per month
- Everything in Free
- Trust scoring
- Webhook alerts
- Priority support
Team
25,000 scans per month
- Everything in Pro
- Team dashboard
- Priority API
- README badge
Overage: $0.005/scan beyond your plan limit. Full pricing details
Start scanning for free.
50 scans per day. No credit card. Install the CLI or hit the API -- your dependencies deserve a second opinion.