Download
Get the NPM Scanner
Run the same scanner PlayCISO uses — against your own repos, packages, or as an automated daily scan.
Step 1 — Get your token
The scanner requires a token tied to your active subscription. Your token is shown once — save it somewhere safe.
Step 2 — Run it
Instant run (npx — no install needed)
npx @playciso-scanner/npm-scanner --token YOUR_TOKEN_HERE
Or install globally
npm install -g @playciso-scanner/npm-scanner npm-scanner --token YOUR_TOKEN_HERE
All modes
Auto mode — replicates PlayCISO master run
npx @playciso-scanner/npm-scanner --token YOUR_TOKEN_HERE
Scan a specific package
npx @playciso-scanner/npm-scanner --token YOUR_TOKEN_HERE --package lodash npx @playciso-scanner/npm-scanner --token YOUR_TOKEN_HERE --package lodash@4.17.21
Scan all deps in a repo
npx @playciso-scanner/npm-scanner --token YOUR_TOKEN_HERE --repo ./my-project npx @playciso-scanner/npm-scanner --token YOUR_TOKEN_HERE --repo github.com/myorg/myrepo
Scan from a list of packages
npx @playciso-scanner/npm-scanner --token YOUR_TOKEN_HERE --file packages.txt
Schedule daily automated run
npx @playciso-scanner/npm-scanner --token YOUR_TOKEN_HERE --schedule daily
Customize policy weights
scanner.config.json
{
"extends": "playciso:defaults",
"limits": { "leads_per_run": 20 },
"scanPolicyOverrides": {
"sp-postinstall-network": { "weight": 60 },
"sp-no-license": { "enabled": false }
}
}npx @playciso-scanner/npm-scanner --token YOUR_TOKEN_HERE --config scanner.config.json
Token limits
- • 200 scan operations per day per token
- • Token validated against your active subscription on each run
- • 24-hour offline grace period if PlayCISO is unreachable
- • Generate a new token any time — old token is revoked automatically