{"opensite":"0.1","url":"https://vu1nz.com/","canonical":"https://vu1nz.com/","site":{"name":"vu1nz","web":"https://vu1nz.com"},"kind":"product","title":"vu1nz","description":"One GitHub Action, two scanners: 17 CI/CD workflow security checks PLUS a malware sweep of every new npm / pip / cargo / gem / go.mod / composer package added in a PR. Catches what CodeQL, Dependabot, and Snyk miss. 14-day free trial, $100/month per GitHub org. Card or crypto.","image":{"url":"https://vu1nz.com/opengraph-image?7641461678692f26"},"language":"en","tags":["cicd security scanner","npm malware scanner","typosquat detector","shai-hulud npm worm","tj-actions changed-files","xz-utils backdoor"],"feeds":[],"published_at":null,"modified_at":null,"fetched_at":"2026-10-19T11:01:59.943Z","status":"live","source":"read","cards":{"og":{"title":"vu1nz — Stop CI/CD & Package Supply-Chain Attacks Before They Merge","description":"One GitHub Action, two scanners. 17 CI/CD checks + malware sweep of every new npm/pip/cargo/gem package in PR. Catches what Dependabot misses. 14-day free trial.","url":"https://vu1nz.com","site_name":"vu1nz","image":"https://vu1nz.com/opengraph-image?7641461678692f26","image:type":"image/png","image:width":"1200","image:height":"630","image:alt":"vu1nz — Stop CI/CD & Package Supply-Chain Attacks Before They Merge","type":"website"},"twitter":{"card":"summary_large_image","creator":"@vu1nz","title":"vu1nz — Stop CI/CD & Package Supply-Chain Attacks Before They Merge","description":"One GitHub Action, two scanners. 17 CI/CD checks + new-package malware sweep on every PR. 14-day free trial. $100/mo per org.","image":"https://vu1nz.com/opengraph-image"}},"jsonld":[{"@context":"https://schema.org","@type":"SoftwareApplication","name":"vu1nz","applicationCategory":"SecurityApplication","operatingSystem":"GitHub Actions, Linux, macOS, Windows","description":"GitHub Action that scans CI/CD workflows AND newly added packages on every PR for supply-chain attacks. 17 CI/CD checks plus npm/pip/cargo/gem package malware detection.","url":"https://vu1nz.com","license":"https://github.com/profullstack/vu1nz.com/blob/main/LICENSE","author":{"@type":"Organization","name":"vu1nz","url":"https://vu1nz.com"},"offers":[{"@type":"Offer","name":"Free Trial","price":"0","priceCurrency":"USD","description":"14-day free trial per GitHub org. No credit card required."},{"@type":"Offer","name":"GitHub Action","price":"100","priceCurrency":"USD","description":"$100/month per GitHub org. Unlimited repos, unlimited scans, both scanners (CI/CD + packages), optional Claude AI review."},{"@type":"Offer","name":"Self-Hosted CLI","price":"0","priceCurrency":"USD","description":"MIT-licensed CLI scanner you can run locally for free."},{"@type":"Offer","name":"Enterprise","price":"499","priceCurrency":"USD","description":"Unlimited orgs, SSO/SAML, compliance reporting, SLA, on-premise option."}]},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"How do I scan my GitHub Actions and PR packages for malware?","acceptedAnswer":{"@type":"Answer","text":"Add the vu1nz reusable GitHub Action to any workflow: `uses: profullstack/vu1nz-gh-actions/.github/actions/vu1nz-actions-scan@v1`. On every push and PR it runs two scanners: 17 CI/CD workflow checks plus a malware/typosquat sweep of every newly added npm, pip, cargo, gem, go.mod, or composer package in the diff. It posts a PR comment and fails the build on high+ severity findings."}},{"@type":"Question","name":"What does vu1nz detect that Dependabot does not?","acceptedAnswer":{"@type":"Answer","text":"Dependabot flags KNOWN CVEs in existing dependencies. vu1nz catches things Dependabot cannot: brand-new packages with no CVE yet, typosquats of popular packages, packages with malicious install scripts, low-reputation maintainers, sudden version-burst patterns (xz-utils style), and tainted package domains (Polyfill.io). Every major npm/PyPI compromise of the last three years had no CVE when it hit production."}},{"@type":"Question","name":"How much does vu1nz cost?","acceptedAnswer":{"@type":"Answer","text":"$100 per month per GitHub org. Unlimited repos, unlimited scans, both scanners included. 14-day free trial on every new org with no credit card. Pay by card or crypto via CoinPay. The CLI is MIT-licensed and free forever for self-hosted use."}},{"@type":"Question","name":"Does vu1nz send my source code anywhere?","acceptedAnswer":{"@type":"Answer","text":"The deterministic scanners run entirely inside your GitHub-hosted runner. Source code never leaves the runner. The optional Claude AI review sends only workflow YAML files (no source, no secrets) to Anthropic, and is opt-in by passing claude_api_key."}}]}]}