First package? Follow the publish and install quickstart →
Enable a release watch
An organization administrator can enable Package inspection in Organization settings. Open a package, choose Inspect release, then Security watch and content scan. Choose a retention period of 1–365 days and enable the watch to queue its first scan.
Content checks stay inside PrivateNPM. Recurring advisory lookups require a separate checkbox: exact dependency names and versions, including private names, will be disclosed to public OSV daily and on retries. Stop the watch to withdraw that consent. A request already in flight may finish, but its result cannot commit after the watch generation changes.
A matching npm lockfile can supply exact transitive identities; ranges and unresolved entries remain unchecked. A supplied lockfile is inventory evidence, not verified build provenance. Watches apply to the selected immutable release; enable another watch for a new release.
Read findings and coverage together
The static scanner checks for selected exposed credential patterns, credential files, install hooks, download/execution patterns and native executables. It never executes scripts or validates a discovered credential against another service. Evidence contains redacted descriptions and tenant-specific fingerprints. Review the original artifact in your own controlled environment and revoke a confirmed exposed credential.
Limits are 32 MiB compressed, 64 MiB expanded, 4096 entries and 1 MiB per inspected file. Traversal, symlinks and malformed archives are rejected. Large files, nested archives and snippet budget limits make coverage incomplete. Failed or partial content checks retain earlier findings. A completed advisory lookup may resolve a corrected or withdrawn advisory; an unavailable provider does not.
OSV supplies advisory IDs, available severity, aliases and fixed range boundaries. OpenSSF malicious-package reports are distinguished from ordinary vulnerabilities. CISA KEV adds a known-exploited signal using public CVE aliases without receiving dependency names. Unknown severity and unavailable exploitation data remain unknown. A public malware name/version match does not establish the origin of a private package with the same name.
Alerts go to current organization administrators when evidence materially changes. Existing notification preferences and digests apply. Temporary suppression requires a reason and expires in at most 90 days. Findings leave access unchanged; an administrator may deliberately quarantine or restore a release from its inspection page.
Use the snippet prototype
Approve a reference's source and license before fingerprinting it locally. The security-scan CLI in the source repository accepts --reference --source https://example.com/source.js --license MIT source.js and emits reference JSON to paste into watch settings. It retains source attribution, declared license and hashes, not the reference text.
This prototype compares windows of 64 normalized tokens against at most 100 approved references. It is not an Internet-wide code corpus. Changed identifiers, absent source and unrepresented projects may be missed; a similarity match is candidate provenance, not an ownership, exploitability or license-violation decision. Files exceeding the token budget remain explicitly incomplete.
Connect CI deployment evidence
Create a management API key with npm:package:read and npm:package:publish. A registry publisher or download token cannot authenticate to this endpoint. Keep the management key in your CI secret store.
After deployment, POST JSON to /api/v1/packages/{packageId}/versions/{version}/security-evidence on your PrivateNPM application origin. Send a stable eventId, kind: deployment, environment, the release's exact artifactIntegrity, and timezone-aware observedAt and expiresAt. The observation must be at most 24 hours old; expiry must be in the future and no more than 30 days away. Reuse the identical payload on retries.
Deployment evidence associates the watched release's inventory with an environment. It records the authenticated submitter and receiving time. It does not prove that the release was executed. See the management API reference for the full request schema.
Runtime agents come later
This first integration accepts CI deployment inventory only. It does not accept Falco events, install an agent, execute customer code or establish runtime reachability. Customer runtime-agent support needs a separate integration with explicit operating-system support and telemetry permissions.