A malicious dependency runs its install script the moment a developer types install, long before anyone knows it is malicious. Your code scanners were looking at the repository. Your endpoint tooling saw a process, not a package. Shield sits on the developer endpoint and blocks it before it executes.
One lightweight agent · Workstations, servers and CI runners · Policy managed centrally
Prevent malicious dependencies and scripts from ever running by protecting developer endpoints where attacks begin.
Shield intercepts package installs in real time and checks them against Xygeni’s malware intelligence. Malicious packages are blocked at the moment of install, not flagged in a report the next morning. The same applies to the network: connections to known-malicious infrastructure are cut before anything leaves the machine.
Define the rules once and Shield applies them on every machine in your organization: minimum package age, allow and deny lists, approved registries, and outbound traffic destinations.
When something critical lands on an endpoint, Shield can cut that machine’s network connections, automatically or on demand, so the incident stops at one laptop instead of spreading through the organization.
A Runtime Firewall for the Developer Endpoint.
Every package install is intercepted and validated in real time. Xygeni’s malware early warning catches malicious packages that reputation-based tooling still trusts, without waiting for a CVE, an advisory, or a published signature. Blocking happens before the install script runs.
The fastest-moving supply chain attacks arrive in brand-new package versions. Shield lets you block packages published more recently than your threshold, set a global rule and override it per ecosystem, and decide what happens when a publication date cannot be determined: warn and allow, or block.
Decide what your developers can pull and where from. Maintain explicit allow and deny lists, and restrict installs to the registries your organization has approved.
The same model applies to connections. Shield checks outbound traffic from the endpoint against up-to-date network intelligence and cuts connections to known-malicious IPs and domains drawn from threat indicators, so an implant that made it onto a machine cannot reach the infrastructure it was built to call. On top of that, you can restrict traffic to high-risk destinations by geography. Every blocked connection is recorded with the destination it tried to reach.
Isolate a compromised machine and cut all outbound traffic except the agent’s own channel, so you keep control of the endpoint while containing it. Turn on paranoid mode and isolation is requested automatically the moment a critical alert lands on any endpoint.
See every workstation, server and CI runner running the Shield agent, with its operating system, agent version, current status, when it was first and last seen, and its license seat. Filter by hostname, endpoint type or status.
Every block becomes an event in the platform, with severity, timestamp, the endpoint it happened on, how long the exposure lasted, and exactly what was blocked: the package and version, or the destination. Filter by severity, category, type, user or date range, and export.
Each protected endpoint carries its own audit trail and component list, so you can reconstruct what happened on a specific machine when someone asks.
One lightweight agent covering workstations, servers and CI runners, with floating seats so coverage follows your people rather than your hardware.
Find and fix API risks in code before they reach production.
Code and dependency scanning analyses the repository. Endpoint tooling watches processes and connections but has no application-security context to interpret a package or a registry. Between those two sits the moment a malicious dependency actually executes, on a developer’s machine. That is where Shield operates.
Reputation and signature-based approaches tell you about a malicious package once somebody else has already been hit by it. Shield blocks on behaviour and risk analysis, which is what makes it useful on the day an attack is new, and backs it with current network intelligence so anything that does land cannot phone home.
 Blocks, isolations and geo events land in the same console as your code, dependency, pipeline and secret findings, with one audit trail. Not another agent with another dashboard and another login.
Endpoint detection watches processes, files and connections at the operating system level. It does not know what a package registry is, whether a dependency is malicious, or whether a version was published yesterday. Shield brings application-security context to the developer endpoint and enforces policy on the things AppSec cares about.
Shield is a lightweight agent that checks installs as they happen. Developers only notice it when something is blocked, and the block comes with the reason.
Malicious and unauthorized package installs, packages that are newer than your minimum-age threshold, installs from registries you have not approved, packages on your deny list, outbound connections to known-malicious IPs and domains, and traffic to geographies you have restricted.
You decide. The minimum-age policy lets you either warn and allow, or block, when the publication date is unknown.
Yes. The global minimum-age threshold can be overridden per ecosystem, and disabled for a specific ecosystem if you need to.
It blocks all outbound traffic from that machine except the Shield agent’s own channel, so the endpoint is contained but still manageable. You can trigger it on demand, or enable paranoid mode so isolation is requested automatically when a critical alert lands.
On developer workstations, on servers, and on CI runners. Licensing uses floating seats.
Yes. Every block is an event with full detail, and each endpoint keeps its own audit trail. Events can be filtered and exported.
with the Xygeni All-In-One AppSec Platform
