Catch malicious behavior
Runs executions in a secure sandbox with decoy honeypots to detect unexpected file access, environment variable theft (/proc/self/environ), process injection (ptrace), fileless execution (memfd_create), and backdoor listeners.
Intelligent False Positive Filtering
Our tracing engine drastically cuts down noise by deduplicating redundant network calls, suppressing expected behavior (like package manager registry queries or default lifecycle scripts), and ignoring benign sandbox initialization (like su/PAM setuid operations).
Full Project Scanning
Use scan-project to analyze entire JS codebases, including lockfile resolution and static registry checks for metadata anomalies and lifecycle scripts.
Advanced Controls
Configure sandbox policies using flags like --network off, --run-as-root, or fine-tune upgrades with --upgrade-mode. CI/CD integration is fully supported via JSON outputs.