cyberxyz-scanner

CyberXYZ Security CLI. Real-time supply-chain protection for npm, PyPI, Go and .NET (NuGet) on macOS, Linux and Windows.

The CLI pairs with the CyberXYZ platform to give you per-machine package inventory, proxy enforcement on every npm, pip, go and dotnet install, and CI/CD gating on flagged dependencies. It is the implementer's interface to a platform that also exposes the same controls in a web dashboard.

Install

The package is published on PyPI as cyberxyz-scanner. The CLI binary it installs is named xyz.

With pip

pip install cyberxyz-scanner

With uv

uv pip install cyberxyz-scanner

Verify the install:

xyz --help

Quick start (one-time per machine)

# 1. Sign in. Opens your browser at app.cyberxyz.io; sign in the way you do on the
#    dashboard (password + authenticator app or passkey, or SSO), check the code
#    matches the terminal, and approve. The CLI never sees your password.
xyz login

# 2. Enroll this machine. One command:
#    - Registers the device with your organization
#    - Points npm (~/.npmrc), pip, Go (GOPROXY) and NuGet at the CyberXYZ proxy,
#      for each one that is installed
#    - Installs the background service for dashboard "Scan now" support
#      (LaunchAgent on macOS, systemd --user on Linux, Task Scheduler on Windows)
xyz proxy setup --machine-name "Alex's MacBook"

Over SSH or on a headless box, xyz login --no-browser prints the link and code to open on any other device (the browser is also skipped automatically when SSH_CONNECTION is set or Linux has no display). The legacy email and password prompt is still available as xyz login --password (or $XYZ_EMAIL / $XYZ_PASSWORD for scripts); accounts with MFA or an SSO-enforcing organization must use the browser login. xyz logout revokes the session on the server and removes it locally.

The CLI session stays signed in while you use it and expires after 90 days without use. While the CyberXYZ agent runs on the machine it refreshes the session daily, so you only sign in once; a machine that stays off for 90 days signs out. It is stored owner-only in ~/.xyz/config.json. Each machine's session is listed under Settings > CLI sessions in the dashboard, where you (or an org admin) can revoke it. Login codes expire after 10 minutes and work once: only approve a code you just requested yourself, never one someone sent you.

That's it. Every later install on this device goes through the CyberXYZ proxy: the exact package version is checked before it downloads, blocked or quarantined packages are refused with the reason, and the install shows up in your dashboard.

For fleets, skip the interactive login: an org admin creates an enrollment token in the dashboard (Machines > Enrollment) and MDM runs xyz proxy setup --enrollment-token pxe_xyz_... (or places the token at /Library/Application Support/CyberXYZ/enrollment-token).

For environments that should not run a long-running background process (CI build agents, sealed builds), pass --no-install-daemon.

On company-managed machines, install the agent at system level so developers cannot stop it:

sudo xyz proxy setup --system          # macOS / Linux
xyz proxy setup --system               # Windows, from an elevated PowerShell

This installs a root/SYSTEM service (macOS LaunchDaemon io.cyberxyz.agent, Linux cyberxyz-agent.service, Windows scheduled task CyberXYZAgent) that starts at boot and restarts if it is killed. The macOS .pkg does the same, and enrolls automatically when MDM places an enrollment token at /Library/Application Support/CyberXYZ/enrollment-token. Without --system (or without admin rights) setup installs the per-user service as before.

Always-on protection

Every minute the background agent checks what each package manager will actually use, repairs anything that no longer points at the CyberXYZ proxy, and reports the result to the dashboard with its heartbeat. Repairs never remove a private or internal registry, and config files are only written for tools that are installed:

The system-level agent does this for every local user account, writing files owned by that user. The machine token is stored where the agent can always read it (/Library/Application Support/CyberXYZ/machine-token, /etc/cyberxyz/machine-token, %ProgramData%\CyberXYZ\machine-token, or ~/.xyz/machine-token per user), so deleting a config file only gets it rewritten. Registry overrides in shell startup files (NPM_CONFIG_REGISTRY, PIP_INDEX_URL, GOPROXY=direct, ...) and in the Windows user environment are reported, never edited.

Network lock. When an org admin turns it on, the system-level agent also maps the public registries (registry.npmjs.org, registry.yarnpkg.com, registry.npmmirror.com, pypi.org, files.pythonhosted.org, proxy.golang.org) to 0.0.0.0 in the hosts file, so tools that ignore config still cannot reach them. NuGet is not locked yet (it relies on config). Edits to the lock are reverted and reported, and the block is removed when the org turns it off.

xyz proxy remove and uninstalling the service are reported to the dashboard before anything is removed. Under the system service, only an administrator can remove it (sudo xyz proxy remove). xyz proxy status shows the per-tool report, the service level and the network lock state.

If CyberXYZ is unreachable

The proxy reuses its verdict for any package it checked in the last 24 hours. For anything else, your org's setting decides: block (the default; the developer sees "retry in a minute") or allow unchecked. Org admins change it in Settings > Supply-chain proxy.

Audit installed packages

Each command below audits the matching ecosystem on this machine, runs the CyberXYZ watchlist + deep check on suspect packages, and uploads the full inventory to the platform.

xyz audit npm                  # local + global node_modules
xyz audit python               # active Python environment via pip
xyz audit go                   # $GOPATH module cache
xyz audit nuget                # packages.lock.json files under cwd
xyz audit                      # npm + python + go back-to-back

By default each command uses the watchlist pre-filter for speed (~25-40s on a typical machine). Pass --full to skip the pre-filter and deep-check every package (slower but covers advisory-only matches at scan time).

Other useful commands

# One-off safety check on a single package + version
xyz check axios 1.14.1 -e npm

# CI/CD gate. Non-zero exit on flagged packages.
xyz depalert scan --package-lock package-lock.json --fail-on block
xyz depalert scan --requirements requirements.txt --fail-on quarantine
xyz depalert scan --requirements poetry.lock      # also Pipfile.lock, uv.lock
xyz depalert scan --go-sum go.sum
xyz depalert scan -p axios@1.14.1 -p lodash@4.17.21

# SBOM upload (CycloneDX or SPDX)
xyz inventory upload ./my-app
xyz inventory upload --sbom syft.json

# Diagnostic / housekeeping
xyz --version
xyz proxy status               # proxy config per tool, service level, network lock
xyz proxy whoami               # what (org, machine) does my token resolve to
xyz proxy remove               # restore default registries (reported to your dashboard)
xyz scans list                 # history of recent scans for your org
xyz upgrade                    # pull the latest release from PyPI

CI/CD integrations

Set XYZ_API_KEY as a secret and add one of these; any push or PR that pulls in a malicious or vulnerable package fails the build with a clear reason.

• GitHub Actions: uses: CyberXYZSecurity/depalert-action@v1 (GitHub Marketplace)
• GitLab CI/CD catalog: gitlab.com/cyberxyz/depalert
• Azure DevOps Pipelines: integrations/azure-pipelines/cyberxyz-supply-chain.yml
• Or generate one: xyz ci init

Route the job's own installs through the proxy (protect)

scan checks lockfiles after the fact. protect runs early in the job and points npm, yarn, pip, uv, Go and NuGet at the CyberXYZ proxy, so a malicious version is refused at install time, the same way it is on laptops. Recommended: protect before the install steps, scan as the gate.

# GitHub Actions
- uses: CyberXYZSecurity/depalert-action@v1
  with:
    api-key: ${{ secrets.XYZ_API_KEY }}
    mode: protect          # network-lock: true also blocks the public registries on the runner
- run: npm ci              # goes through the proxy
- uses: CyberXYZSecurity/depalert-action@v1
  with:
    api-key: ${{ secrets.XYZ_API_KEY }}   # mode: scan (default) gates on the lockfiles

GitLab: include gitlab.com/cyberxyz/depalert/protect@1.1.0 and add extends: .cyberxyz-protect (or - !reference [.cyberxyz-protect, before_script]) to the jobs that install dependencies. Any other CI: eval "$(xyz ci protect --format shell)" with XYZ_API_KEY set. If CyberXYZ is unreachable, protect warns and the build carries on unprotected; pass --strict (strict: true) to fail it instead.

All of them run the same xyz depalert scan engine your laptops use. It reads package-lock.json, requirements*.txt, Pipfile.lock, poetry.lock, uv.lock and go.sum.

depalert scan exit codes

Re-enroll, rotate, remove

To rotate the proxy token on a device, re-run xyz proxy setup --machine-name "..." as the same user who enrolled it. The platform replaces the old token and the daemon picks up the new one at next restart. A machine name registered by another member of your org can only be re-issued by an org admin; pick a different --machine-name otherwise.

To remove a device cleanly, delete it from the dashboard Fleet view. The deletion sweeps proxy_install_log, proxy_tokens, cli_scans, customer_inventory_uploads, customer_package_inventory and scan_jobs in one transaction. Re-enroll with the same command above.

Platform

• Dashboard: https://app.cyberxyz.io
• Documentation: https://cyberxyz.io

License

Proprietary. See LICENSE.

Contact

Email: amro@cyberxyz.io