Kavyr is a pre-install security scanner for JavaScript package managers (npm, pnpm, yarn, bun). It scans packages BEFORE installation to protect against supply-chain attacks, malware, and typosquatting.

How do I install Kavyr?

On macOS/Linux: curl -fsSL https://kavyr.dev/install.sh | bash. On Windows: irm https://kavyr.dev/install.ps1 | iex

Does Kavyr work with npm, pnpm, yarn, and bun?

Yes, Kavyr works with all major JavaScript package managers: npm, pnpm, yarn, and bun.

Kavyr includes 2 free package detections per month so you can try it. After that, scanning pauses until the next month or until you upgrade. Pro is €4/month with a 7-day trial and unlimited detections.

What threats does Kavyr detect?

Kavyr detects supply-chain attacks, typosquatting (fake package names), known malware, credential theft attempts, malicious install scripts, and suspicious network activity.

Scans packages before they install

Your dependencies are
a security risk.

Name: Kavyr CLI
Rating: 5 (1 reviews)
Author: Kavyr

Every npm install downloads code you've never reviewed. One compromised package in your tree – and your users pay the price.

Start Protecting Your Projects Learn why this matters

The Problem

Supply chain attacks are not theoretical.
They happen every week.

The average project

A typical React app has 1,200+ transitive dependencies. Each one is code you implicitly trust. Each one can execute arbitrary scripts during install. Each one could be compromised tomorrow.

You review your own code. But do you review your dependencies? Do you review their dependencies? Nobody does.

The attack surface

→Typosquatting: electron vs electorn
→Compromised maintainer accounts
→Malicious postinstall scripts
→Dependency confusion attacks
→Abandoned packages taken over

Real incidents

event-stream2018

Bitcoin wallet theft via popular package

ua-parser-js2021

Crypto miners injected into 7M+ weekly downloads

node-ipc2022

Protestware wiped files on Russian/Belarusian systems

colors/faker2022

Maintainer sabotaged own packages, broke thousands of apps

"We built Kavyr because we were tired of hoping our dependencies were safe. We wanted to know before we installed."

The Solution

Kavyr scans before you install.

Intercepts every package manager command. Analyzes packages for threats. Blocks the dangerous ones. You keep working as usual.

Install once

One command sets up shell integration. Works with npm, pnpm, yarn, and bun.

$ curl -fsSL kavyr.dev/install.sh | sh

Use your package manager normally

No new commands to learn. No workflow changes. Kavyr works transparently.

$ npm install axios

Threats get blocked

Every package is scanned. Safe packages install normally. Dangerous ones are stopped.

$ npm install electorn

Scanning electorn@1.0.0...

✗ Blocked: Typosquatting detected (similar to: electron)

Install cancelled. Run with --force to override.

Features

Multi-layer protection.

Each layer catches threats the others might miss. Together, they form a comprehensive defense.

CVE Database

Real-time checks against the OSV vulnerability database. Known vulnerabilities are flagged before they enter your project.

Malware Blocklist

Curated list of known malicious packages. Updated continuously as new threats are discovered.

Typosquatting Detection

Catches deceptive package names designed to trick you. Compares against popular packages using multiple algorithms.

Version Anomaly Detection

Pro

Flags suspicious changes between versions. Score applies on try detections; full reasons unlock on Pro (or as a high-risk preview).

Script Analysis

Pro

Install scripts that touch credentials or make outbound HTTP raise the risk score. Detailed findings unlock with Pro.

Static Code Signals

Pro

AST, entropy, and taint heuristics contribute to the risk score. Detailed findings unlock with Pro or on high-risk preview.

Installation

Get started in 30 seconds.

One command. Works with npm, pnpm, yarn, and bun.

$curl -fsSL https://kavyr.dev/install.sh | sh

After installation

1.Restart your terminal (or run source ~/.bashrc)
2.Use npm/pnpm/yarn/bun as usual – Kavyr intercepts automatically
3.Dangerous packages are blocked before installation
4.Try it: kavyr scan electorn@1.0.0 — expect a block (typosquat of electron)

Pricing

Try 2 detections / month. Pro unlocks unlimited.

After your monthly try quota, Kavyr stops scanning until next month or Pro. Installs still proceed — you just lose the safety net.

Try

See Kavyr work — then upgrade

€0

2 package detections / month
Full scan depth on those detections
After that: scans pause (installs still work)
Quota resets each month
No credit card required to try

Install Kavyr

Pro

Unlimited protection · 7-day trial

€4/month

Unlimited detections
Full finding details + ML signals
API key for CLI linking
Dashboard & scan history
7-day free trial

Start free trial

Team

For development teams

€4/person/month

Flat €4/person/month (same as Pro per seat)

Everything in Pro (unlimited)
Team management & invites
Shared allow/block lists
Seat-based billing via Stripe

Create a team

Your dependencies area security risk.

Supply chain attacks are not theoretical.They happen every week.