Supply-chain risk you can read.
Paste an npm package, PyPI module, or GitHub repository. Dralvia walks the dependency tree, fingerprints post-install scripts, deobfuscates payloads, and surfaces maintainer-change risk, with line-level evidence and an EvidencePack you can attach to the procurement record.
Repository security
See Dralvia in action.
Review source packages for SBOM, secret, dependency, and provenance risks in one workflow.
- Submit a supported repository package
- Track the review
- Export evidence into existing AppSec workflows
This preview shows the Dralvia workspace. Sign in to see your own scans, alerts, and activity.
Is this package malicious right now, not just "does it have a CVE."
Dralvia focuses on supply-chain compromise: post-install behaviour, maintainer-change risk, and typosquatting, cross-referenced with advisory data (OSV.dev) and static analysis.
Post-install & lifecycle scripts
Install hooks that fetch remote payloads, spawn shells, or exfiltrate environment variables, the most common malware delivery path in package ecosystems.
Obfuscation & deobfuscation
Minified or encoded payloads are unpacked and re-analysed, so hidden behaviour cannot ride in behind a wall of obfuscation.
Maintainer-change signal
Who published this version, when they got write access, and how their history compares to the prior maintainer. Sudden handoffs to brand-new accounts are a strong signal.
Typosquat & dependency confusion
Edit-distance neighbours of popular packages, scope-vs-bare-name confusion, and internal-package name collisions checked against the registry.
Secret scanning
Live tokens, cloud keys, private keys, database URIs, and webhook URLs surfaced from source, useful both for "is this package leaking?" and "did our team commit something?"
Transitive walk
Dralvia does not stop at the direct dependency. It walks the full tree, scores each node, and surfaces the deepest finding, even six layers down.
Repository signal
For GitHub: branch protection, recent force pushes, contributor history, signed-commit consistency, and CI that runs untrusted code in a privileged context.
Ecosystem reputation
Cross-reference against published advisories (OSV.dev), prior incident reports, and Dralvia's own clustering of malicious-publisher accounts.
From package name to procurement evidence.
Point at a package or repo
npm package, PyPI module, or public GitHub repository. Dralvia resolves the manifest and builds the dependency graph.
Static, structural, transitive
Lifecycle scripts, deobfuscation, secret scanning, and advisory cross-reference run across every node, without executing the package.
Line-level evidence
A clear verdict, the deepest finding in the tree, and an EvidencePack you can attach to the procurement or merge record.
Honest answers.
npm, PyPI, and public GitHub repositories are live today. Other ecosystems such as Crates, RubyGems, Maven, and Go modules are on the roadmap, tell us what is blocking you.
Scan a dependency before you ship it.
Paste a package or repository, read the supply-chain signal, and attach the evidence to your review.
Supply chain is more than packages.
Read the contract behind the dApp
Owner privilege, hidden mint, and approval-drain vectors before funds move.
Inspect the install link
Typosquatted download pages and fake registries start with a lookalike URL.
Vet the vendor's domain
Registrar history, DNS posture, and lookalikes before you onboard a dependency source.