cyberxyz-scanner

CyberXYZ Security CLI. Real-time supply-chain protection for npm, PyPI, Go and .NET (NuGet) on macOS, Linux and Windows.

PyPI version Python License

The CLI pairs with the CyberXYZ platform to give you per-machine package inventory, proxy enforcement on every npm install / pip install, and CI/CD gating on flagged dependencies. It is the implementer's interface to a platform that also exposes the same controls in a web dashboard.

Install

The package is published on PyPI as cyberxyz-scanner. The CLI binary it installs is named xyz.

With pip

pip install cyberxyz-scanner

With uv

uv pip install cyberxyz-scanner

Verify the install:

xyz --help

Quick start (one-time per machine)

# 1. Browser-based login. Stores a JWT in ~/.xyz/config.json
xyz login

# 2. Enroll this machine. Single command does all of:
#    - Registers the device server-side
#    - Writes the proxy token to ~/.npmrc
#    - Configures pip's global index URL
#    - Installs the OS service for dashboard "Scan now" support
#      (LaunchAgent on macOS, systemd --user on Linux, Task Scheduler on Windows)
xyz proxy setup --machine-name "Alex's MacBook"

That's it. Every subsequent npm install and pip install on this device is checked through the CyberXYZ proxy, and the dashboard's "Scan now" button can trigger a fresh inventory audit on demand.

For environments that should not run a long-running background process (CI build agents, sealed builds), pass --no-install-daemon.

Audit installed packages

Each command below audits the matching ecosystem on this machine, runs the CyberXYZ watchlist + deep check on suspect packages, and uploads the full inventory to the platform.

xyz audit npm                  # local + global node_modules
xyz audit python               # active Python environment via pip
xyz audit go                   # $GOPATH module cache
xyz audit nuget                # packages.lock.json files under cwd
xyz audit                      # npm + python + go back-to-back

By default each command uses the watchlist pre-filter for speed (~25-40s on a typical machine). Pass --full to skip the pre-filter and deep-check every package (slower but covers advisory-only matches at scan time).

Other useful commands

# One-off safety check on a single package + version
xyz check axios 1.14.1 -e npm

# CI/CD gate. Drops a non-zero exit on flagged packages.
xyz depalert scan --package-lock package-lock.json --fail-on block
xyz depalert scan --requirements requirements.txt --fail-on quarantine
xyz depalert scan -p axios@1.14.1 -p lodash@4.17.21

# SBOM upload (CycloneDX or SPDX)
xyz inventory upload ./my-app
xyz inventory upload --sbom syft.json

# Diagnostic / housekeeping
xyz proxy status               # show current npm + pip proxy config
xyz proxy whoami               # what (org, machine) does my token resolve to
xyz proxy remove               # restore default registries on this machine
xyz scans list                 # history of recent scans for your org
xyz upgrade                    # pull the latest release from PyPI

CI/CD integrations

Drop one of the templates below into your repo, set XYZ_API_KEY as a secret, and any push or PR that pulls in a malicious or vulnerable package will fail the build with a clear reason.

  • GitHub Actions: .github/workflows/xyz-depalert.yml (template in the XYZ-APT-Scanner repo)
  • Azure DevOps Pipelines: integrations/azure-pipelines/cyberxyz-supply-chain.yml

Both run the same xyz depalert scan engine your laptops use.

Re-enroll, rotate, remove

To rotate the proxy token on a device, just re-run xyz proxy setup --machine-name "...". The platform revokes the old token and writes a fresh one. The daemon picks it up at next restart.

To remove a device cleanly, delete it from the dashboard Fleet view. The deletion sweeps proxy_install_log, proxy_tokens, cli_scans, customer_inventory_uploads, customer_package_inventory and scan_jobs in one transaction. Re-enroll with the same command above.

Platform

License

Proprietary. See LICENSE.

Contact

Email: amro@cyberxyz.io

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (1.4.55)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for CyberXYZ from gravatar.com CyberXYZ

Credits

Author: CyberXYZ Security Team

License

Other/Proprietary License (Proprietary)

Requires

Python >=3.8

Tags

CVE EPSS GHSA OSV scanner security vulnerability

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

cyberxyz_scanner-1.4.54.tar.gz (133.1 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

cyberxyz_scanner-1.4.54-py3-none-any.whl (116.9 kB view details)

Uploaded Python 3

File details

Details for the file cyberxyz_scanner-1.4.54.tar.gz.

File metadata

  • Download URL: cyberxyz_scanner-1.4.54.tar.gz
  • Upload date:
  • Size: 133.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for cyberxyz_scanner-1.4.54.tar.gz
Algorithm Hash digest
SHA256 8886889bf1c8076f14ca7b8ad495c2ed51da7e9c7ba7cffb94616f01aab3a4ad
MD5 00531616600c11751538cc0c3d52bb9f
BLAKE2b-256 6b168b46c791618289e93037bfb2a78c3168f91c0b1a9029e9beb0044b6b5fc6

See more details on using hashes here.

Provenance

The following attestation bundles were made for cyberxyz_scanner-1.4.54.tar.gz:

Publisher: publish-to-pypi.yml on CyberXYZSecurity/XYZ-Exploitability-Scanner

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file cyberxyz_scanner-1.4.54-py3-none-any.whl.

File metadata

File hashes

Hashes for cyberxyz_scanner-1.4.54-py3-none-any.whl
Algorithm Hash digest
SHA256 77377c45ef7da4bb47811a9f329964ef559fb266a66027987c722fdb6bfc6650
MD5 c254567d6c0d98651995fdbdba67735c
BLAKE2b-256 62d53ee597faf4d471b54b4b831e944c00688d67ac316de7eb38763342b2ad9f

See more details on using hashes here.

Provenance

The following attestation bundles were made for cyberxyz_scanner-1.4.54-py3-none-any.whl:

Publisher: publish-to-pypi.yml on CyberXYZSecurity/XYZ-Exploitability-Scanner

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

1.4.55

2 files

This release

1.4.54 This release

2 files

1.4.53

2 files

1.4.52

2 files

1.4.51

2 files

1.4.50

2 files

1.4.49

2 files

1.4.48

2 files

1.4.47

2 files

1.4.46

2 files

1.4.45

2 files

1.4.44

2 files

1.4.43

2 files

1.4.42

2 files

1.4.41

2 files

1.4.40

2 files

1.4.39

2 files

1.4.38

2 files

1.4.37

2 files

1.4.36

2 files

1.4.35

2 files

1.4.34

2 files

1.4.33

2 files

1.4.32

2 files

1.4.28

2 files

1.4.27

2 files

1.4.26

2 files

1.4.25

2 files

1.4.24

2 files

1.4.23

2 files

1.4.22

2 files

1.4.21

2 files

1.4.20

2 files

1.4.19

2 files

1.4.18

2 files

1.4.17

2 files

1.4.16

2 files

1.4.15

2 files

1.4.14

2 files

1.4.13

2 files

1.4.12

2 files

1.4.11

2 files

1.4.10

2 files

1.4.9

2 files

1.4.8

2 files

1.4.7

2 files

1.4.6

2 files

1.4.5

2 files

1.4.4

2 files

1.4.3

2 files

1.4.2

2 files

1.4.1

2 files

1.4.0

2 files

1.3.4

2 files

1.3.3

2 files

1.3.2

2 files

1.3.1

2 files

Yanked

1.3.0

2 files

Yanked reason: moving it to another project

Yanked

1.2.0

2 files

Yanked

1.1.0

2 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page