Package Zero-trust eXecute

Secure Javascript Ecosystem supply chain. Advanced SCA and isolated runtime validation.

Scans your filesystem, resolves real installed versions, checks OSV for CVEs, runs supply chain heuristics, performs AST analysis with Bun.Transpiler, and detonates suspicious packages in a sandboxed environment. Zero dependencies.

Usage

bunx @georgegiosue/pzx lodash

bunx @georgegiosue/pzx [package] [version] [--root <path>] [--home] [--lang <lang>] [--help]

bunx @georgegiosue/pzx                              # scan ALL installed packages
bunx @georgegiosue/pzx lodash 4.17.20               # check specific package
bunx @georgegiosue/pzx express --home               # scan from home directory
bunx @georgegiosue/pzx @babel/core -r ~/projects    # scan specific path
bunx @georgegiosue/pzx lodash --lang es             # output in Spanish

Without arguments, pzx enters full scan mode: discovers every installed package, runs static analysis locally, and only queries external APIs for packages flagged as suspicious.

Analysis Engines

| Engine | What it does | |--------|-------------| | OSV | Checks installed versions against known CVEs | | Registry | Detects abandonment, deprecation, quarantine, typosquatting | | Regex IoC | eval(), child_process, base64, IP URLs, env exfiltration | | AST | Bun.Transpiler import scanning for sensitive system modules | | Dep audit | Random names, URL/IP/file versions in sub-dependencies | | Sandbox | Detonates suspicious packages with intercepted fetch, fs, exec |

Sandbox

Packages flagged by static analysis are executed in a controlled environment:

• Mock environment intercepts fetch, fs, child_process, http/https
• Empty env — no AWS_SECRET_KEY, no NPM_TOKEN, nothing to steal
• 1500ms timeout — kills the process if it blocks (C2 wait, infinite loop)
• Violations are classified: NETWORK, EXEC, FS_READ

Exit Codes

0 no vulnerabilities | 1 error | 2 vulnerabilities found

License

MIT

Acknowledgements

Most (if not all) of this was built by AI xd