Kavyr Documentation
Pre-install security scanner for npm packages
What is Kavyr?
Kavyr is a security tool that scans npm packages before you install them. It wraps your package manager (npm, pnpm, yarn, bun) and checks every package against known threats, malicious patterns, and suspicious behavior.
→ Think of it as a security checkpoint that runs automatically every time you install a package.
Installation
macOS / Linux
curl -fsSL https://kavyr.dev/install.sh | bashWindows
irm https://kavyr.dev/install.ps1 | iexAfter installation, restart your terminal. Kavyr will automatically protect all future package installations.
How It Works
- 1
Intercept
Kavyr wraps your package manager. When you run
npm install lodash, Kavyr catches it first. - 2
Scan
The package is checked against our threat database, analyzed for malicious patterns, and scored for risk.
- 3
Decide
Safe packages are installed normally. Risky packages show a warning. Malicious packages are blocked.
CLI Commands
| Command | Description |
|---|---|
| kavyr status | Show current protection status |
| kavyr scan <package> | Manually scan a package without installing |
| kavyr login | Open browser to link this device |
| kavyr login <api_key> | Save Pro API key from the dashboard |
| kavyr sync | Refresh Pro status after login / key |
| kavyr toggle | Enable/disable protection |
| kavyr trust <package> | Whitelist a package you trust |
| kavyr update | Update Kavyr to latest version |
| kavyr uninstall | Remove Kavyr from your system |
Experimental (Pro beta)BETA
Runtime monitoring is optional and not part of the core pre-install product yet. Prefer wrapper + scan reliability first.
| Command | Description |
|---|---|
| kavyr monitor status | Show runtime monitoring status |
| kavyr monitor enable | Enable experimental runtime monitoring |
| kavyr monitor disable | Disable runtime monitoring |
| kavyr monitor threats | Show detected runtime threats |
What We Detect
🚫 Known Malware
Packages flagged in security advisories and CVE databases
🔤 Typosquatting
Fake packages mimicking popular libraries (lodahs, reacct)
⚡ Malicious Scripts
Suspicious postinstall, preinstall scripts
📊 Anomaly Detection
Sudden changes in package behavior or ownership
🔒 Credential Access
Code accessing ~/.ssh, ~/.aws, or environment variables
🌐 Network Exfiltration
Suspicious outbound connections during install
Try vs Pro
| Feature | Try | Pro |
|---|---|---|
| Detections included | 2 / month | Unlimited |
| Blocklist Scanning | ✓ | ✓ |
| Typosquat Detection | ✓ | ✓ |
| CVE Database | ✓ | ✓ |
| Script / version anomaly (score) | ✓ | ✓ |
| Full finding details | preview on risk | ✓ |
| ML Anomaly Detection | – | ✓ |
| Dashboard & API key | basic | ✓ |
| Runtime monitoring | – | beta |
FAQ
Does Kavyr slow down my installations?
Scans typically take 100-500ms. If the API is slow or unreachable, Kavyr falls back to allow the installation.
What data do you collect?
We collect an anonymous device ID and the names of scanned packages. No source code, no personal data, no tracking. See our Privacy Policy.
Can I use Kavyr in CI/CD?
Yes! Kavyr works in any environment. For CI, you can use the install script in your pipeline and it will protect all package installations.
What if Kavyr blocks a legitimate package?
Use kavyr trust <package> to whitelist it. If you think it's a false positive, let us know!
Need Help?
Have questions or found a bug? Reach out at hello@kavyr.dev or open an issue on GitHub.