GitHub App
Block malicious dependencies in the pull request — before they merge.
Install the PkgRadar GitHub App and it runs as a check on every pull request: it scans each dependency your PR adds or upgrades and fails the check if one behaves like malware. One click, no workflow file, no agents. It reads only the dependency changes in your diff — never your source code.
Install the GitHub AppSee audited accuracy
Free to install and gate PRs within the free monthly quota — see pricing. Prefer a pipeline step? There’s a CLI and composite Action too.
How it works
A PR check that fails on a malicious dependency
When a pull request changes your dependencies, the App scans each newly added or upgraded package and posts a check run named PkgRadar / malicious-dependency-gate. A clean PR passes silently; a PR that pulls in a malicious package fails the check, with the flagged package named and a link to its evidence report.
- Open or update a pull request that adds or bumps a dependency.
- PkgRadar scans the changed packages across all six supported ecosystems.
- The check passes if they’re clean, or fails — before merge — if one is malicious.
Privacy by design
It never sees your source
The App requests only two permissions — pull_requests:read and checks:write. It has no contentsaccess, so it can’t read your repository files. It works entirely from the dependency lines in the pull-request diff, which is all it needs to know what you’re about to install. Your code never leaves GitHub.
Coverage
Six ecosystems, the same gate
It reads the dependency manifests and lockfiles for npm, PyPI, Cargo, Go, RubyGems, and NuGet. Because detection is static behavioral analysis rather than a known-bad list, it flags malicious releases that don’t have a public advisory yet — see the flagged-first coverage and lead-time receipts.
FAQ
Common questions
Does the GitHub App read my source code?
No. It reads only the dependency changes in the pull-request diff — the added/changed lines of your lockfile or manifest. It requests just pull_requests:read and checks:write. It has no contents permission, so your source never leaves GitHub.
What does it check, and when?
On every pull request, it scans each newly added or upgraded package across npm, PyPI, Cargo, Go, RubyGems, and NuGet, and posts a check named “PkgRadar / malicious-dependency-gate”. If a package behaves like malware — install hooks, obfuscated payloads, credential/wallet theft, remote-code fetches, exfiltration — the check fails before the PR can merge.
Is it a CVE / vulnerability scanner?
No. It’s specifically about malicious packages, not known CVEs. It’s static behavioral analysis, so it flags malicious releases that don’t have an advisory yet — the precision and recall are published live at /accuracy.
How much does it cost?
There’s a free tier — install it and gate PRs within the free monthly quota, no credit card. See /pricing.
Ready?