Supply Chain Risk Intelligence
PlayCISO runs this scanner every day against the most-downloaded npm packages — scoring each one against 50 risk policies covering install scripts, ownership changes, typosquats, obfuscation, and more. Paid users can download the same scanner and run it against their own repos and packages.
Risk distribution
Most triggered policies
How the scanner works
Lead discovery
Finds high-download npm packages using 10 lead-scoring policies — weighing download surface, maintainer count, ownership changes, and install scripts.
Policy scan
40 scan policies run against each lead — checking for malicious install scripts, env exfiltration, obfuscated eval, typosquats, abandoned packages, and more.
Risk scoring
Each package gets a 0-100 risk score and a Critical/High/Medium/Low rating. Full evidence logged per policy hit so you know exactly what triggered.
Run it in your own environment
Paid users can download the same scanner and point it at their own package lists, repos, or private registries — with one command.