OSS Packages

The OSS Packages page provides visibility into all open-source packages that have been installed or used on developer machines. This includes packages installed by human developers as well as packages installed by tools or AI coding agents.

It supports both browsing the full package inventory and running targeted or incident-driven searches, making it easier to quickly identify exposure during a supply chain incident.

Browsing packages

The package inventory shows every package detected across your active devices, with a total count summarized at the top (for example, total npm packages across active devices). Use the ecosystem toggle to switch between npm and PyPI inventories.

For each package, the table shows:

• Latest: the most recent version detected on your devices
• Versions: how many distinct versions exist across devices
• Devices: how many devices have the package

Install type badges indicate how the package is present:

• Active: the package is actively installed
• Direct: the package is a direct dependency of a project
• Global: the package is installed globally on the machine

Use the search box to find a package by name, or select Export CSV to download the inventory.

Package details

Select a package to open its detail panel. The panel summarizes the number of devices with the package, the number of distinct versions, and the latest version.

From here you can:

• Filter by install type: Active installs, Direct dependency, or Global install
• View the version distribution: each detected version or version range with the number of devices it appears on
• Review the Devices list to see every device with the package, its serial ID, and the specific versions present on that device
• Search the device list or select Export CSV to download it

This is the fastest way to answer "which machines have the compromised version" during an incident.

Searching with filters

Select Open advanced search to open the OSS Package Search page, where you can run targeted or incident-driven queries across developer devices using Search Filters:

• Package ecosystem: JS or Python
• Search Type: choose a search mode, such as Custom Search
• Device: scope the search to a specific device or all devices
• Package Status: filter by package status
• Time Range: restrict results to a date range
• Package and Versions: enter a package name and one or more versions (for example, 1.0.0); select Add Package to search for multiple packages at once, which is useful when checking exposure to a campaign that compromised several packages

Select Search to run the query, Reset to clear the filters, or Browse all packages to return to the full inventory.

Follow this interactive demo to see how it works:

Package Locations on Developer Machines

For each package match, Dev Machine Guard shows the exact location where the package exists on the developer machine.

This includes:

• Package manager used (for example, npm or yarn)
• Project paths where the package is installed

This information is critical for remediation, especially during active supply chain incidents.

Remediation and Verification

Using the package location information, you can create an MDM or EDR script to remove the affected packages from developer machines.

After the package is removed, you can rescan the device and verify that the package is no longer present.

Upcoming Capabilities

The following capabilities are currently in development and will be available in a future release:

• Package allowlists to define which packages are permitted across developer machines
• Cooldown periods for new package versions, preventing newly published updates from being installed until they have been evaluated