How a check works
The check, step by step
Most package checks take a few minutes. Repositories and installers take longer. An identical check finished in the last 24 hours is reused.
- 1Find itFor a package, QuickChain reads the registry for versions, publish date, license, repository, maintainers, install scripts and deprecation. For a repository link it makes a shallow, read-only copy of the public repository at the newest release tag. If there is no release tag it uses the default branch and the report says so.
- 2What it installsWorks out the exact set of packages a consumer would get without running any of them. npm runs with install scripts off, PyPI uses prebuilt wheels only, Go isn’t built, and Maven, NuGet and Rust are resolved from their published metadata.
- 3Known vulnerabilitiesMatched from advisory data kept offline in the product, for npm, PyPI, Go, Maven and Gradle, NuGet, Rust, Ruby, PHP, Swift and CocoaPods, Dart and Flutter, Elixir and Erlang, R, Haskell, OCaml, Julia, Perl, conda and C/C++. Each one comes with the versions it affects, whether it’s known to be exploited, and its EPSS score.
- 4Whether the code calls itQuickChain traces the software’s own code to see if it reaches the vulnerable function. This works best for Go, JavaScript, TypeScript and Python, partly for Ruby and PHP, and only in a limited way for Java and .NET. A finding it sets aside states its evidence. One it can’t decide stays open at the advisory’s severity.
- 5The rest of the softwareRepositories, release downloads, installers and models also get checked for secrets, network behavior and offline readiness, what they install and run, deployment configuration, code weaknesses, licenses, signatures, installer contents, model files, and maintenance.
- 6RecommendationApprove, approve with conditions, reject, or incomplete when a key check couldn’t finish. The result is also scored against your workspace’s intake policy, and an owner can change those rules. QuickChain suggests a safer version or an alternative when there is one.
Every finding goes in one of three piles
Example: pdf-export-kit 2.1.0, 42 findings.
Needs a judgment
Critical or high by its advisory (or as QuickChain rates it for this use), known exploited, or not rated, and not shown to be uncalled: a person decides.
Rated lower
QuickChain rates them lower for this use: each row says why, after the advisory's severity.
Not called by this software
The check traced its code and it never calls the vulnerable code, or set it aside with evidence (only in build, test or example files, or not affected).
pdf-export-kit/lib/export.js:88 → crypto-hash.digest() → vulnerable function named in the advisory
How the rating is set
Every rule that fires shows up as a reason, worst first. A Blocked package can’t be approved as it is. The developer sees the safer options instead.
- BlockedThe package, or something it brings in, has a malicious-package report. Or the checked version is affected by an advisory that is known to be exploited.
- High riskA Critical or High finding in what it installs, an advisory rated High or Critical on the checked version, or its own code calls vulnerable code.
- Moderate riskMedium findings, a deprecated or unmaintained package, a security practices score under 4 out of 10, install scripts, or more than 150 packages installed.
- Low riskNone of the above.
Where checks run and what comes out
- Requests
- A developer pastes a package name or a link, or several at once. The check runs on QuickChain, so nothing is installed on their machine.
- Pull requests
- With the QuickChain GitHub App and the GitHub Action, a pull request that adds a public direct dependency gets it checked automatically. The Action lists the checks in its summary and can fail the job on High or Blocked.
- Against a project
- Check a package for a specific project and the report adds what changes for that project: new packages, version conflicts, findings the project didn’t have before, and license concerns.
- Exports
- A one-page summary, and the full report as HTML, Word, Markdown or JSON. OpenVEX for the vulnerabilities, findings and components as CSV, and a SHA-256 file manifest for repository checks. The decision log and approved software list download as CSV.
Limits
- Public software only
- A name that matches your workspace’s internal package names, or one of your internal GitHub organizations, is refused and never looked up publicly. There is no login to private registries.
- No AI on your code
- The checks are rule-based. No source code is sent to an AI model.
- Package names
- npm, PyPI, Go, Maven, NuGet and crates.io. Software from elsewhere can be checked from its GitHub repository, a release download or a Hugging Face model. Hugging Face datasets aren’t supported yet.
- Packages by name
- These get the vulnerability, install, license and maintenance checks. Secrets, network behavior, code weaknesses and the other software checks run on repositories, downloads and models. Every report lists what ran and what didn’t.
- Call tracing
- Limited for Java and .NET, partial for Ruby and PHP. Findings it can’t decide stay open for a person.
Questions engineers ask
What can a developer ask QuickChain to check?
A package from npm, PyPI, Go, Maven, NuGet or crates.io, by name or registry link, with a version if they need a specific one. They can also paste a link to a public GitHub repository, a release download or installer, or a Hugging Face model.
Does QuickChain run the software it checks?
No. Nothing scanned is ever built or run. To see what a package installs, QuickChain resolves it the way your build would, with npm install scripts turned off, PyPI limited to prebuilt wheels, no Go build, and Maven, NuGet and Rust read from their published metadata. Installers are unpacked and read, and model weights are inspected without being loaded.
What happens with our internal package names?
QuickChain only looks up public software. A name that matches your workspace’s internal package names, or one of your internal GitHub organizations, is refused and never looked up publicly.
Is any source code sent to an AI model?
No. The checks are rule-based and give the same result for the same input. No source code is sent to an AI model.
How long does a check take?
Most package checks finish in a few minutes. Repositories and installers take longer. The request page updates by itself, and an identical check finished in the last 24 hours is reused.
Can new dependencies in pull requests be checked?
Yes. With the QuickChain GitHub App installed and the GitHub Action in your workflow, any public direct dependency a pull request adds is checked automatically. The Action can fail the job when a check comes back High or Blocked.
What can a reviewer export?
Each check has a one-page summary for leadership and a full report, which downloads as HTML, Word, Markdown or JSON. There is also an OpenVEX file, the findings and components as CSV, and for repository checks a SHA-256 manifest of the files that were checked. The decision log and the approved software list download as CSV.
How well does the call tracing work in each language?
It’s strongest for Go, JavaScript and TypeScript, and Python. Ruby and PHP are partly covered, and Java and .NET only in a limited way. When QuickChain can’t tell whether the vulnerable code is called, the finding stays open at the advisory’s severity for a person to judge.
Does it suit classified or air-gapped networks?
That’s who we built it for. QuickChain keeps its advisory data offline, inside the product. Mark a request for a classified or air-gapped network and the recommendation gets stricter: telemetry and update checks have to be off, installers that download and run code need a condition, and an unsigned release needs a SHA-256 transfer manifest.
How accurate is it?
We ran it on 24 open-source repositories it had never seen and compared the results with an independent reference. It missed none of the 654 advisories in the reference and set none aside wrongly. Its OpenVEX statements matched its own report on all 989 findings.
Bring a package your team is waiting on
On the call we’ll check it together, so you see the findings and the decision packet for something you actually need.