How it works / Lens

Scrutyn Lens

Multi-engine threat analysis

Lens checks every package for malware, suspicious install-time behaviour and known threats before we serve it, using layered analysis, with AI review when the evidence is uncertain.

Why it matters

Waiting buys time, but something still has to look at the code. Malicious packages try to steal credentials and tokens, open a backdoor or download a second payload, often behind obfuscation or a lookalike name. Age and popularity alone don’t tell you that.

How it works

  • Known malicious packages: matched against public malware and advisory feeds, rechecked continuously.
  • Suspicious changes between versions: a new install script, a new maintainer, lost build provenance, or a brand-new package with few downloads.
  • Risky code: static analysis of install hooks and source for patterns like credential theft, download-and-run and obfuscated payloads.
  • Known malware signatures in files and bundled binaries.
  • AI review only when the engines disagree or are unsure. It never reviews every package, and on its own it never blocks a version permanently.

What you get

Each version is screened once and the verdict is shared across every account. Anything suspicious is held for review instead of guessed at, and every verdict comes with its reason.

scrutyn why @sample/http-kit@4.1.0Example
on hold for review
install script added in 4.1.0
maintainer changed since 4.0.2
not served until the review clears it
On hold

Lens looks for malicious packages, not vulnerable ones. A known vulnerability doesn’t hold or block a version on its own; advisories only shorten the wait for the version that fixes one. The engines and their licences are listed in the technical docs.

What you control

  • Why a version is held: scrutyn why, the dashboard, or MCP.
  • Exceptions for versions that are only waiting (never for held or blocked ones).
  • The full review workflow and history on Pro and Team.

No scanner catches everything. Lens lowers the risk; it can’t promise a package is free of malware. Security model & limits

Where it sits in the flow

  1. Your package manager asks Scrutyn

    npm, pnpm, Yarn, Bun, pip, uv or Poetry sends the request with this device’s token. Your account’s policy applies from here.

  2. Two independent checks decide what is listed

    LazarettoLens

    Lazaretto checks age: versions younger than your window (7 days by default, 0 to 30) are left out. Lens checks the verdict: anything held or blocked is left out. A version nobody has requested yet is listed once it is old enough, and screened before its file is served.

  3. Depot delivers our stored copy

    Depot

    Installs come from Scrutyn’s own copy, served only with a clean verdict and checked against its hash on every request. A stored copy is never refetched from the public registry.

  4. You see it, and we keep watching

    Every download lands in your activity log. Stored versions are re-evaluated as feeds change; if one is later found malicious, a recall tells you which devices downloaded it.

Included in every plan

Lens is part of the one Scrutyn service; there’s no separate product or price. Compare plans, or see Lazaretto and Depot.