Dependency execution intelligence
Security for the code you didn’t write.
Modern software is assembled, not written. depgaze watches what every dependency does as it installs — and blocks the malicious, the abandoned, and the risky before they ever reach production.
- CI/CD native
- npm + PyPI
- Bring your own LLM
- Agent Skills Orchestrated
malicious@0.1BlockedBehaves like credential theft — reaches out to a server it has no reason to contact while installing.
Fix: remove it before it runs — rotate any exposed tokens.
lodash@4.17.21AllowedClean. Does exactly what a utility library should — and nothing else.
Supply chain security by the numbers
454,648
malicious packages in 2025
9.8T
registry downloads in 2025
~9 mo
avg breach detection time
$4.91M
avg supply-chain breach cost
The problem
Most of your software is code you never reviewed.
Every modern application depends on hundreds of open-source packages. Each one runs arbitrary code the moment it installs — with full access to your filesystem, network, and credentials.
A single compromised maintainer account, a typo-squatted name, or a poisoned update is all it takes. By the time an advisory lands, the code has already executed in your CI pipeline.
You hand-pick about ten dependencies. Your build pulls in more than eighty — most of them transitive, none of them reviewed. That invisible majority is now the #1 attack surface in software.
| Per project | npm | PyPI |
|---|---|---|
| You actually choose | ~10 | ~6 |
| Your build installs | 80-85+ | 15-20 |
| Transitive multiplier | 7.5x-10x | 2x-3x |
| Tree depth | 4.39 levels | 1.7 levels |
| Extreme (frameworks) | 50x-100x | < 5x |
How it works
Embed it in your pipeline. Ship with confidence.
depgaze runs locally on Linux inside a signed environment image, remotely on Windows through the depgaze headless platform, or directly inside a CI pipeline on any Linux-based runner. It works with the LLM provider you already use — Amazon Bedrock, OpenAI, Anthropic, Azure Foundry, xAI, or local Ollama models. One CLI command, and every package is checked before it touches production.
Talk to us, get set up
We walk you through what depgaze does and how it fits your stack. Once you pick a plan, our team helps you set up the CLI, configure your infrastructure to host the depgaze platform, and integrate it into your CI pipeline.
Setup depgaze with usConfigure your environment
On Linux, initialize the local sandbox and verify your runtime and LLM provider are ready. On Windows, skip this step — remote execution through the depgaze headless platform handles it.
depgaze initdepgaze checkAnalyze a package
Run locally on a Linux host or remotely from Windows through the depgaze headless platform. Each package installs inside an isolated, disposable sandbox with deep OS-level behavioral instrumentation.
depgaze npm install --package lodashdepgaze pip install --package requestsdepgaze npm install --package react --remoteAct on the verdict
Exit code 0 allows a package; exit code 1 blocks it. Plug it into any CI pipeline on a Linux-based runner — a blocked package stops the build. Fail-closed by default.
depgaze npm install --package lodash --jsondepgaze npm install --package @slidev/cli --ram 1024 --vcpu 2Give it to your AI agents
Install the depgaze skill into Claude Code or Codex so AI agents can call depgaze during development. Every dependency an agent adds gets a behavioral verdict before it reaches your codebase — no human in the loop required.
depgaze setup skilldepgaze setup skill --globalIn action
It watches what a package actually does.
depgaze doesn’t scan source code or match patterns against a blocklist. It installs each package inside a disposable depgaze signed environment image instrumented at the OS level — capturing real OS-level behavior during the actual installation process. The LLM verdict is based on what the package did at runtime, not what its code looks like.
- OS-level behavioral instrumentation, not source-code heuristics
- Every process spawn, file write, and network call is captured
- Plain-language verdicts with a specific fix
- Fail-closed — if in doubt, it blocks
$ depgaze npm install --package malicious@0.1
→ ran the install in a disposable environment — nothing touched the host
! spawned a hidden background process
! read ~/.npmrc — your registry credentials
! opened a connection to 23.105.x.x
————————————————
BLOCKEDlooks like credential exfiltration
FIXremove it, and rotate anything it could read
Why depgaze
Existing defences read the code. We watch the behaviour.
The field is full of scanners, vulnerability databases, and registry firewalls. Every one of them judges a package before it runs, or watches after it is installed. depgaze is the only gate that executes the install in an isolated sandbox and blocks on what it actually does.
Lockfiles
Pin versions, but don’t detect malicious code injected into a pinned version.
Audit tools (npm audit, pip-audit)
Check known CVEs, but miss zero-day compromises and hijacked maintainer accounts.
Provenance verification (SLSA, Sigstore)
Verify build origin, but can’t detect a compromised CI pipeline producing valid provenance.
Static LLM scanners
Reason about what code looks like. Obfuscation, staged payloads, and dynamically constructed downloads slip past.
depgaze — the difference
To our knowledge, the combination of per-install disposable isolation, OS-level behavioral observability, and LLM analysis of the live runtime trace as a pre-install gate is novel among published approaches.
Runtime behavior, not source code
Every published approach in the field reasons about what a package’s code looks like — its source, AST, or statically derived features. depgaze reasons about what the install actually does.
Isolated, disposable execution
Each install runs inside a fresh, disposable depgaze signed environment image with no access to the host filesystem, network, or credentials. The environment is destroyed after every run — nothing survives.
OS-level observability
Behavioral probes capture every process spawn, file read and write, and network connection — scoped to the install process. The instrumentation is package-manager-agnostic.
Pre-install gate, not post-hoc classifier
depgaze blocks before anything reaches the host. Fail-closed: if the LLM is unreachable or returns a malformed response, the verdict is always block.
Research dataset
Every install builds the dataset.
depgaze offers an opt-in research programme. When enabled, the behavioral fingerprint of each audited package — the processes it spawned, the files it wrote, the connections it opened — is contributed to a growing dataset of real-world package-installation behaviour across npm and PyPI.
No proprietary code or credentials ever leave your environment. The dataset captures the behavioural trace only — what the install did, not what your project contains.
A behavioral fingerprint dataset
Every opt-in analysis produces a structured record: process trees, file-system mutations, network connections, and the LLM verdict. Over time this compounds into a labelled dataset of how packages actually behave during installation — legitimate and malicious alike.
Built for AI training and labelling
The dataset is designed to serve organisations working in AI labelling, model training, and security research. Structured behavioral data from real package installs — with allow/block verdicts attached — is a resource that doesn’t exist at scale today. It can power classifiers, fine-tune security models, and train the next generation of automated supply-chain defences.
Strictly opt-in
Data contribution is off by default. You choose whether to participate, and you can revoke at any time.
Pricing
One price. Total protection.
Every plan includes unlimited seats and unlimited usage. No per-user fees, no analysis caps — your whole team is covered.
Basic
For teams getting started with behavioral analysis
- ✓Unlimited seats & usage
- ✓depgaze CLI
- ✓npm + PyPI coverage
- ✓CI/CD integration
- ✓Bring your own LLM
- ✓Setup support (offline)
- ✓Software updates
- ✗depgaze headless CLI
- ✗depgaze remote platform
- ✗Setup support (online)
- ✗Direct engineering support
- ✗Influence roadmap
Pro
Full platform access for growing engineering teams
- ✓Unlimited seats & usage
- ✓depgaze CLI
- ✓npm + PyPI coverage
- ✓CI/CD integration
- ✓Bring your own LLM
- ✓depgaze headless CLI
- ✓depgaze remote platform
- ✓Setup support (offline)
- ✓Software updates
- ✗Setup support (online)
- ✗Direct engineering support
- ✗Influence roadmap
Enterprise
For organisations that need hands-on partnership
- ✓Unlimited seats & usage
- ✓depgaze CLI
- ✓npm + PyPI coverage
- ✓CI/CD integration
- ✓Bring your own LLM
- ✓depgaze headless CLI
- ✓depgaze remote platform
- ✓Setup support (online & offline)
- ✓Software updates
- ✓Direct engineering support
- ✓Influence roadmap & request features
All plans are billed annually. By subscribing you accept the End-User Licence Agreement. Need something custom? Get in touch.
About the team
Built by engineers who ship.
Giancarlo Lelli
Technology Founder & Product Builder
MSc in Computer Science. 10+ years in technology consulting, now a Forward Deployed Engineer & Cloud GTM Lead. Took depgaze from threat model to a working, multi-ecosystem product — low-level systems engineering, a cross-platform developer CLI, and applied LLM security analysis, already in the loop.
LinkedInFAQ
Questions teams ask first.
Vulnerability scanners match packages against a database of known CVEs. depgaze installs the package inside an isolated, disposable environment and watches what it actually does — processes spawned, files accessed, network connections opened. Zero-day attacks and hijacked maintainer accounts are caught on first contact, not after an advisory is published.
npm and PyPI are fully supported today. Each package manager is handled natively — depgaze runs the real install command, not a simulation.
A single package analysis typically completes in under a minute. You can run depgaze in parallel across dependencies in your pipeline script, and the --remote flag offloads execution to the depgaze platform so your runner stays free.
Yes. Run depgaze setup skill to install the depgaze skill into Claude Code or Codex. Once installed, agents call depgaze automatically before adding any dependency — no human in the loop required.
No. depgaze only installs and observes the public package you point it at. Your project files, credentials, and environment variables are never read, sent, or exposed. You can also bring your own LLM provider to keep the analysis trace entirely in-house.
depgaze is fail-closed by default. If the LLM provider is unavailable or returns an invalid response, the verdict is always block. Nothing gets through without a definitive allow.
The remote platform lets you run behavioral analysis from Windows — without local sandbox prerequisites. Your CLI submits jobs to a depgaze headless worker and polls for results. Available on the Pro and Enterprise plans.
When enabled, the behavioral fingerprint of each analysed package — processes, file mutations, network activity, and the verdict — is contributed to a growing dataset of real installation behaviour. The dataset serves AI labelling and security research. It is strictly opt-in and can be revoked at any time.
Get in touch
Secure the code your team never wrote.
Tell us what you’re shipping and we’ll help you set up depgaze across your infrastructure and CI pipelines.