The problem
A routine lockfile update can introduce hundreds of transitive changes. Developers need to know what changed, how a package reaches their application and whether a release matches what their team approved.
Our approach
Provenyx analyses package-lock files without installing or running packages. It combines evidence-backed detection rules, dependency paths, OSV checks and release verification in a VS Code extension, web dashboard and pull-request trust gate.
What it enables
- Safe lockfile analysis with explicit consent
- Interactive dependency paths and evidence
- Pull-request checks and release verification