Supply Chain Risk Intelligence
PlayCISO runs this scanner every day against the most-downloaded npm packages — scoring each one against 50 risk policies covering install scripts, ownership changes, typosquats, obfuscation, and more. Paid users can download the same scanner and run it against their own repos and packages.
Risk distribution
Most triggered policies
How the scanner works
Lead discovery
Finds high-download npm packages using 10 lead-scoring policies — weighing download surface, maintainer count, ownership changes, and install scripts.
Policy scan
40 scan policies run against each lead — checking for malicious install scripts, env exfiltration, obfuscated eval, typosquats, abandoned packages, and more.
Risk scoring
Each package gets a 0-100 risk score and a Critical/High/Medium/Low rating. Full evidence logged per policy hit so you know exactly what triggered.
Run it in your own environment
Paid users can download the same scanner and point it at their own package lists, repos, or private registries — with one command.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.