Transitive view
Score the whole tree, not just the line you added.
01Dependency risk scoring that ships
VIXPURGE
Know what a package really pulls in before the lockfile moves — as a check, not a lecture.
Overview
Runs
Policies
Traces
Settings
Dependencylive
6 hto flag a malicious publish
18kpackages scored daily
Transitive viewok
PR checkok
Provenanceok
Teams shipping with Vixpurge
NorthwindKestrelRuangPolarTokoLumenBakauVela
6 hto flag a malicious publish
18kpackages scored daily
0false blocks in a month
What you get
Three things Vixpurge does properly.
PR check
A risky addition blocks the merge with the reason attached.
02Provenance
Who published it, from where, and whether the signature matches.
03Inside the product
One screen, the whole picture.
Overview
Runs
Policies
Traces
Settings
Dependencylive
6 hto flag a malicious publish
18kpackages scored daily
Transitive viewok
PR checkok
Provenanceok
“A crypto-miner landed in a transitive dependency. We knew six hours later, not six weeks.”
Ivan D. — platform engineer, Berlin
Pricing
Start free. Pay when it earns it.
Questions
The things people ask first.
Do you need my source?+
A lockfile is enough.
How do you score?+
Maintainer history, publish patterns, install scripts, provenance, blast radius.
Can I allowlist?+
Yes, with an owner and an expiry — no permanent exceptions.
Vixpurge is open for design partners.
Small team, direct access to the people who build it. Bring a real workload.
Request access