2024: 7,000+ malicious npm packages detected

Your dependencies are
a security risk.

Every npm install downloads code you've never reviewed. One compromised package in your tree – and your users pay the price.

Start Protecting Your ProjectsLearn why this matters

The Problem

Supply chain attacks are not theoretical.
They happen every week.

The average project

A typical React app has 1,200+ transitive dependencies. Each one is code you implicitly trust. Each one can execute arbitrary scripts during install. Each one could be compromised tomorrow.

You review your own code. But do you review your dependencies? Do you review their dependencies? Nobody does.

The attack surface

  • →Typosquatting: lodash vs lodsah
  • →Compromised maintainer accounts
  • →Malicious postinstall scripts
  • →Dependency confusion attacks
  • →Abandoned packages taken over

Real incidents

event-stream2018

Bitcoin wallet theft via popular package

ua-parser-js2021

Crypto miners injected into 7M+ weekly downloads

node-ipc2022

Protestware wiped files on Russian/Belarusian systems

colors/faker2022

Maintainer sabotaged own packages, broke thousands of apps

"We built Kavyr because we were tired of hoping our dependencies were safe. We wanted to know before we installed."

The Solution

Kavyr scans before you install.

Intercepts every package manager command. Analyzes packages for threats. Blocks the dangerous ones. You keep working as usual.

1

Install once

One command sets up shell integration. Works with npm, pnpm, yarn, and bun.

$ curl -fsSL kavyr.dev/install.sh | sh
2

Use your package manager normally

No new commands to learn. No workflow changes. Kavyr works transparently.

$ npm install axios
3

Threats get blocked

Every package is scanned. Safe packages install normally. Dangerous ones are stopped.

$ npm install lodsah
Scanning lodsah@1.0.0...
✗ Blocked: Typosquatting detected (similar to: lodash)
Install cancelled. Run with --force to override.

Features

Multi-layer protection.

Each layer catches threats the others might miss. Together, they form a comprehensive defense.

CVE Database

Real-time checks against the OSV vulnerability database. Known vulnerabilities are flagged before they enter your project.

Malware Blocklist

Curated list of known malicious packages. Updated continuously as new threats are discovered.

Typosquatting Detection

Catches deceptive package names designed to trick you. Compares against popular packages using multiple algorithms.

Version Anomaly Detection

Pro

Alerts when a new version contains suspicious changes – unexpected network calls, file system access, or obfuscated code.

Behavioral Sandbox

Pro

Executes install scripts in isolation to detect runtime malicious behavior before it touches your system.

Quarantine Mode

Pro

Automatically holds new versions of popular packages until they've been verified by the community.

Installation

Get started in 30 seconds.

One command. Works with npm, pnpm, yarn, and bun.

$curl -fsSL https://kavyr.dev/install.sh | sh

After installation

  1. 1.Restart your terminal (or run source ~/.bashrc)
  2. 2.Use npm/pnpm/yarn/bun as usual – Kavyr intercepts automatically
  3. 3.Dangerous packages are blocked before installation

Pricing

Start free. Upgrade when you need more.

Free

For individual developers

€0
  • CVE & vulnerability scanning
  • Malware blocklist
  • Typosquatting detection
  • Unlimited scans
Get Started

Pro

For professional developers

€4/month
  • Everything in Free
  • Version anomaly detection
  • Script analysis
  • Behavioral sandbox
  • Quarantine mode
  • Priority support
Start Free Trial

Team

For development teams

€4/person/month

€3/person for 5+ members

  • Everything in Pro
  • Team management
  • Shared allow/block lists
  • Audit logs
  • SSO integration
Start Free Trial