How it works / Lazaretto

Scrutyn Lazaretto

Package quarantine

The Lazaretto buys time. New versions wait before they are admitted, so a malicious release has time to be discovered and blocked before it reaches you. 7 days by default; you choose.

Why it matters

Malicious releases are usually found by someone: maintainers, scanners, advisory feeds, the registry itself. Until then, version ranges and AI agents reach for the newest release automatically, so they are the first to be hit. Waiting keeps you out of that first window.

How it works

  • Versions younger than your window are left out of the version list your package manager sees.
  • latest is rewritten when it points at a version that is still waiting.
  • Waiting delays good fixes too, so versions an advisory lists as the fix can clear sooner, and an admin can approve an audited exception for one version.
  • The age check is independent of Lens: a version must be old enough and have an acceptable verdict.

What you get

A plain install gets the newest version that has finished waiting and passed Lens, while the new one gets time to be checked. An exact pin to a waiting version fails; scrutyn why gives the reason and the date its wait ends.

Version list for @sample/http-kitExample
4.1.0 published 2 days ago wait ends Oct 4
4.0.2 published 41 days ago listed
latest 4.0.2 (rewritten from 4.1.0)
In Lazaretto

What you control

  • The window: 0 to 30 days, 7 by default.
  • A shorter wait for versions an advisory lists as the security fix.
  • Exceptions, requested by anyone or any agent, approved only by an admin.

Waiting doesn’t detect anything by itself, and a release that stays undiscovered past your window isn’t caught by waiting alone. Security model & limits

Where it sits in the flow

  1. Your package manager asks Scrutyn

    npm, pnpm, Yarn, Bun, pip, uv or Poetry sends the request with this device’s token. Your account’s policy applies from here.

  2. Two independent checks decide what is listed

    LazarettoLens

    Lazaretto checks age: versions younger than your window (7 days by default, 0 to 30) are left out. Lens checks the verdict: anything held or blocked is left out. A version nobody has requested yet is listed once it is old enough, and screened before its file is served.

  3. Depot delivers our stored copy

    Depot

    Installs come from Scrutyn’s own copy, served only with a clean verdict and checked against its hash on every request. A stored copy is never refetched from the public registry.

  4. You see it, and we keep watching

    Every download lands in your activity log. Stored versions are re-evaluated as feeds change; if one is later found malicious, a recall tells you which devices downloaded it.

Included in every plan

Lazaretto is part of the one Scrutyn service; there’s no separate product or price. Compare plans, or see Depot and Lens.