> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/developer-machines/packages/oss-packages.md).

# OSS Packages

The **OSS Packages** page provides visibility into all open-source packages that have been installed or used on developer machines. This includes packages installed by human developers as well as packages installed by tools or AI coding agents.

It supports both browsing the full package inventory and running targeted or incident-driven searches, making it easier to quickly identify exposure during a supply chain incident.

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2F2JHLYVMXpcCZ755KCDmc%2FScreenshot%202026-11-11%20at%2011.29.41.png?alt=media&amp;token=1d966763-7293-40db-9f4c-80b5e4dda8ee" alt=""><figcaption></figcaption></figure>

### Supported ecosystems

Select an ecosystem at the top of the page to switch the inventory:

* **JavaScript**
* **Python**
* **Go**
* **Rust**
* **PHP**
* **.NET**
* **Ruby**
* **Conda**
* **Java**
* **Swift**
* **Homebrew**

{% hint style="info" %}
Go, Rust, PHP, .NET, and Ruby inventory requires Dev Machine Guard agent v1.18.0 or later. Conda, Java, and Swift inventory requires agent v1.19.0 or later.
{% endhint %}

For the ecosystems added in v1.18.0 and v1.19.0, Dev Machine Guard builds the inventory passively by reading files on disk. It does not run package managers, build tools, or project code. The agent collects:

| Ecosystem | What Dev Machine Guard reads                                                                                                                       |
| --------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Go**    | Projects and workspaces, vendored modules, the module cache, and installed Go tools                                                                |
| **Rust**  | Cargo manifests and workspaces, `Cargo.lock`, the registry cache, and installed binaries                                                           |
| **PHP**   | Project and global Composer declarations, lock files, and installed package receipts                                                               |
| **.NET**  | SDK-style and legacy project references, central package versions, restored, locked, and cached NuGet packages, and .NET tools and templates       |
| **Ruby**  | Gemfiles and gemspecs, lock files, and installed and cached gems across rbenv, RVM, asdf, mise, chruby, Homebrew, system, and RubyInstaller rubies |
| **Conda** | Environment receipts, manifests, explicit files, and conda-lock and pixi lock files                                                                |
| **Java**  | Project declarations, dependency locks, version catalogs, Maven local repositories, Gradle caches, and Gradle verification metadata                |
| **Swift** | `Package.resolved` pins, workspace state, package caches, registry downloads, binary artifact records, and Xcode project and workspace locations   |

### Browsing packages

The package inventory shows every package detected for the selected ecosystem, with a summary at the top (for example, *Total 8,093 npm packages across 23 active devices*).

For each package, the table shows:

| Column           | Description                                                        |
| ---------------- | ------------------------------------------------------------------ |
| **Package**      | The package name. Select it to open the package detail panel.      |
| **Latest**       | The most recent version detected on your devices                   |
| **Versions**     | How many distinct versions exist across devices                    |
| **Installed as** | Badges that show how the package is present on devices (see below) |
| **First seen**   | When the package was first detected on any device                  |
| **Last seen**    | When the package was most recently detected on any device          |
| **Devices**      | How many devices have the package                                  |

The **Installed as** badges are:

* **Active**: the package is actively installed
* **Direct**: the package is a direct dependency of a project
* **Global**: the package is installed globally on the machine

The table is sorted by **Devices** by default, so the most widely installed packages appear first. Use the search box to find a package by name, or select **Export CSV** to download the inventory as a comma-separated values (CSV) file.

### Package details

Select a package to open its detail panel.

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2FTlt8zP9hb5IRtazx4ykG%2FScreenshot%202026-11-11%20at%2012.09.58.png?alt=media&amp;token=ee900452-b9fb-41e3-8d27-6fdcc826cc29" alt=""><figcaption></figcaption></figure>

The summary cards at the top of the panel show:

* **Devices**: how many devices have the package
* **Versions**: how many distinct versions exist across devices
* **Latest version**: the most recent version detected on your devices
* **Active on**: how many devices have the package actively installed

**Package information** shows:

* **Ecosystem**: the ecosystem and its package registry (for example, *JavaScript (npm)*)
* **Installed as**: the install type badges for the package
* **Package managers**: each package manager the package was installed with, and the number of devices for each (for example, `npm`, `yarn`, `pnpm`, `bun`, and `yarn-berry`)
* **First seen** and **Last seen**: when the package was first and most recently detected

**Version distribution** lists each detected version or version range with the number of devices it appears on, ordered by device count.

**Devices** lists every device with the package.

Use **Search devices** to filter the list, or select **Export CSV** to download it.

This is the fastest way to answer "which machines have the compromised version?" during an incident.

### Searching with filters

Select **Advanced search** to open the **OSS Package Search** page, where you can run targeted or incident-driven queries across developer devices using **Search Filters**:

* **Package ecosystem**: JS, Python, Go, Rust, PHP, .NET, Ruby, Conda, Java, Swift, or Homebrew
* **Search Type**: choose a search mode, such as **Custom Search**
* **Device**: scope the search to a specific device or **All Devices**
* **Package Status**: filter by package status
* **Time Range**: restrict results to a date range
* **Package** and **Versions**: enter a package name and one or more versions (for example, `1.0.0`). Select **Add Package** to search for multiple packages at once, which is useful when checking exposure to a campaign that compromised several packages.

Select **Search** to run the query, **Reset** to clear the filters, or **Browse all packages** to return to the full inventory.

**Follow this interactive demo to see how it works:**

{% embed url="<https://app.storylane.io/share/ikokjxskmmum>" %}

### Package Locations on Developer Machines

For each package match, Dev Machine Guard shows the exact location where the package exists on the developer machine.

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2FFuSjxIfOkBEvheN3TweI%2FScreenshot%202026-04-23%20at%2012.12.25.png?alt=media&#x26;token=de508d08-9c2e-4f24-99fb-a04f793239c7" alt=""><figcaption></figcaption></figure>

This includes:

* Package manager used (for example, npm or yarn)
* Project paths where the package is installed

This information is critical for remediation, especially during active supply chain incidents.

### Remediation and Verification

Using the package location information, you can create a mobile device management (MDM) or endpoint detection and response (EDR) script to remove the affected packages from developer machines.

After the package is removed, you can rescan the device and verify that the package is no longer present.

<figure><img src="https://754495266-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQJRZY4cfEeY3I7DXTOCp%2Fuploads%2FzlD648wbfmXziVRbkBvW%2FScreenshot%202026-04-23%20at%2012.16.54.png?alt=media&#x26;token=d84db96f-d3c2-4854-a2b6-4e83ba145728" alt=""><figcaption></figcaption></figure>

### Upcoming Capabilities

The following capabilities are currently in development and will be available in a future release:

* **Package allowlists** to define which packages are permitted across developer machines
* **Cooldown periods for new package versions**, preventing newly published updates from being installed until they have been evaluated


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stepsecurity.io/developer-machines/packages/oss-packages.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.