Stop malicious packages at the registry level, before they reach a single user. Built for registry operators and security teams that defend developer ecosystems.
"Yeeth Security helped us enhance the security framework of the Open VSX Registry. Their work introduced pre-publish checks, quarantine workflows, and threat-informed detection mechanisms that significantly strengthen the platform's security while keeping the publishing process straightforward for extension publishers."
"North Korean hackers are turning developer tools into malware delivery channels."
Independent coverage of Yeeth Security's discovery of the ByteBinTools SharePoint C2 backdoor loitering inside the Visual Studio Code Marketplace.
Control-Point Architecture
Commercial registry interception paired with free, open-source enforcement for developer IDEs and AI coding agents.
Pre-publish malware scanning that runs inside the registry. Malicious packages are quarantined before they ever go live.
Open-source extension that surfaces Argus risk scores inside VS Code, Cursor, Windsurf, VSCodium, and other Open VSX editors.
Pre-install CLI hooks for Claude Code and autonomous coding agents. Blocks typosquats and malicious packages before install scripts run.
Check any package, extension, or AI agent skill across 6 independent security engines—argus, guarddog, skillspector, depsdev, osv, and grype—for malware and known vulnerabilities in one verdict.
Frontline Threat Intelligence
Primary-source malware disclosures, supply chain investigations, and registry research from the Yeeth team.
Threat Intel
Binance lost about $6.3 billion and says no private key leaked. Its own signing infrastructure produced every signature the attacker need...
Read briefing
Threat Intel
A 15 KB page-speed script walked Polymarket's React tree, found the live order client, and used the site's own gasless relayer to move ab...
Read briefing
Threat Intel
A 1 KB change to a Capacitor config file turns four ordinary developer actions into remote code execution, and the implant's failure mode...
Read briefingOpen Standards
Our newest work is a vendor-neutral standard for package security, now an Eclipse Foundation project.
Supply Chain Intelligence Exchange. One API between registries and security scanners: a common verdict model, consumer policy, and signed webhooks. Registries can mix or swap scanners without rewriting integrations.
See it live pkgscan.dev Scan any package with 6 independent engines through SCINTX. One verdict.Why Pre-Publish & Runtime Defense Matters
Attackers rotate publisher identities, stage clean placeholders, and trigger payloads in seconds. Here is what changes when you defend the control points directly.
npm, pip, and MCP servers without pre-install verification.node binaries, MP4 steganography, and blockchain dead-dropsWork With Us
We work directly with registry operators and security leaders on pre-publish scanning deployments, registry hardening, incident response, and detection engineering.