> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/developer-machines/packages/oss-packages.md).
# OSS Packages
The **OSS Packages** page provides visibility into all open-source packages that have been installed or used on developer machines. This includes packages installed by human developers as well as packages installed by tools or AI coding agents.
It supports both browsing the full package inventory and running targeted or incident-driven searches, making it easier to quickly identify exposure during a supply chain incident.
### Browsing packages
The package inventory shows every package detected across your active devices, with a total count summarized at the top (for example, total npm packages across active devices). Use the ecosystem toggle to switch between **npm** and **PyPI** inventories.
For each package, the table shows:
* **Latest**: the most recent version detected on your devices
* **Versions**: how many distinct versions exist across devices
* **Devices**: how many devices have the package
Install type badges indicate how the package is present:
* **Active**: the package is actively installed
* **Direct**: the package is a direct dependency of a project
* **Global**: the package is installed globally on the machine
Use the search box to find a package by name, or select **Export CSV** to download the inventory.
### Package details
Select a package to open its detail panel. The panel summarizes the number of devices with the package, the number of distinct versions, and the latest version.
From here you can:
* Filter by install type: **Active installs**, **Direct dependency**, or **Global install**
* View the version distribution: each detected version or version range with the number of devices it appears on
* Review the **Devices** list to see every device with the package, its serial ID, and the specific versions present on that device
* Search the device list or select **Export CSV** to download it
This is the fastest way to answer "which machines have the compromised version" during an incident.
### Searching with filters
Select **Open advanced search** to open the **OSS Package Search** page, where you can run targeted or incident-driven queries across developer devices using Search Filters:
* **Package ecosystem**: JS or Python
* **Search Type**: choose a search mode, such as Custom Search
* **Device**: scope the search to a specific device or all devices
* **Package Status**: filter by package status
* **Time Range**: restrict results to a date range
* **Package and Versions**: enter a package name and one or more versions (for example, `1.0.0`); select **Add Package** to search for multiple packages at once, which is useful when checking exposure to a campaign that compromised several packages
Select **Search** to run the query, **Reset** to clear the filters, or **Browse all packages** to return to the full inventory.
**Follow this interactive demo to see how it works:**
{% embed url="" %}
### Package Locations on Developer Machines
For each package match, Dev Machine Guard shows the exact location where the package exists on the developer machine.
This includes:
* Package manager used (for example, npm or yarn)
* Project paths where the package is installed
This information is critical for remediation, especially during active supply chain incidents.
### Remediation and Verification
Using the package location information, you can create an MDM or EDR script to remove the affected packages from developer machines.
After the package is removed, you can rescan the device and verify that the package is no longer present.
### Upcoming Capabilities
The following capabilities are currently in development and will be available in a future release:
* **Package allowlists** to define which packages are permitted across developer machines
* **Cooldown periods for new package versions**, preventing newly published updates from being installed until they have been evaluated
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/developer-machines/packages/oss-packages.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.