Know What's In Your Artifacts
Before You Ship Them
PolySwarm scans your container images and open-source packages against its engine network and returns a clear go/no-go call, with the scores and the reasoning behind it.
Now in research preview. Request access and help shape what we build next.
Four checks, on every artifact
PolySwarm looks past the manifest and inspects what actually ships.
Malware in the artifact
Every binary on the entrypoint path is scanned by the PolySwarm engine network, so known and emerging malware is caught before the image or package reaches production.
Released-code integrity
We compare the released artifact against its source tree at the published tag and flag anything in the archive that is not in the tagged source, the code injected at release time that legacy scanners checking published metadata miss.
Source-level security
We resolve the source repository that builds your container's entrypoint and run deep source analysis on it, surfacing memory-safety and input-validation flaws in the code behind the binary, not just the packaged image.
Threat-actor context
Risk is scored against active campaigns targeting your stack and ecosystem, so a package under live attack is weighted higher when it matters most.
How it works
Point the scanner at an artifact
Scan an OCI or Docker image, or an open-source package from npm or PyPI, from your desk, your CI pipeline, or a Kubernetes admission gate.
We inspect what ships
The scanner extracts the layers, scans every binary on the entrypoint path, compares the released artifact against its source tree to catch code injected at release time, resolves and security-analyzes the source repository behind the entrypoint, and correlates findings against active threats.
Get one go/no-go score
You get a Risk Assessment from 0 to 100 and a Source Verification score, with the rationale behind them, so the call to ship or hold is clear and defensible.
What a result looks like
Illustrative examples. Every scan returns a Risk Assessment from 0 to 100, a Source Verification percentage, a ship or hold call, and the findings behind it.
nginx:1.25-alpine- No malware found on the entrypoint path
- Source behind the entrypoint scanned clean
- No active campaigns targeting this image
[email protected]- Code in the release is missing from the tagged source (injected at release time)
- High and critical flaws in the source behind the package
- Maintainer account linked to an active campaign
Research preview questions
Container image scanning and open-source package scanning, with a Risk Assessment, a Source Verification score, and the reasoning behind each verdict. Access is by request while container scanning is in research preview.
Most scanners check published metadata against a CVE list. PolySwarm inspects the actual binaries that ship and compares the released package against its source tree, so it catches malware and code injected at release time, not just known CVEs.
At a developer's desk, inside CI, or as a Kubernetes admission step. The preview focuses on container images and npm and PyPI packages, with more ecosystems on the way.
Your feedback shapes the product during the research preview. Request access and tell us about your stack and what you need next, and our team will follow up directly.
Join the research preview
Request access and help shape where container scanning goes next. Tell us about your stack and we will get you set up.