Which package managers does Dazio support?

Ecosystem	Tools	Malware found on disk	Installs checked
npm	npm, npx, pnpm, yarn, bun	Yes	Yes
PyPI	pip, uv, uvx, poetry, pdm, pipx	Yes	Yes
RubyGems	gem, bundler	Yes	Yes
Cargo	cargo	Yes	Yes
Go modules	go	Yes	Yes
NuGet	dotnet, nuget	Yes	Yes
Composer	composer	Yes	No
Editor extensions	VS Code, Cursor, Windsurf	Yes	No
Agent skills	Claude, Codex and others	Yes	No
Homebrew	brew	In progress	No
Maven and Gradle	mvn, gradle	In progress	No

What it checks has the full table, including what each scan reads and how each install is hooked.

I already have antivirus, and my company runs an EDR. Why do I need this?

Keep them; they do a different job. Antivirus and EDR inspect binaries and catch code that’s already running. A malicious package is a plain-text script that arrives through a tool you trust, and it runs with your permissions the moment it installs. By the time an EDR notices anything, your tokens have already left.

Dazio checks each package as your package manager downloads it, before any of its install scripts run. Always-on protection refuses the install by default; warn mode records the detection and lets it proceed. See What it checks for the modes and for what install checks do not see.

Does it run on my machine?

Dazio runs on macOS and Linux. Windows is not supported yet. See Install.

Will it slow down my installs?

The check runs on your machine, against the local copy of the malware feed, so it adds no network round trip to the install.

What leaves my machine?

No package name is sent anywhere to be checked, and your code, secrets, file paths and package inventory stay local. With analytics on, the default, Dazio reports counts of what scans find, error classes, and on a malware match the threat and the package name and version. The malware feed needs analytics on: turning analytics off also stops the feed’s hourly updates. Registration, the update check and, once you accept the feed terms, the first scan’s feed snapshot happen whatever the analytics setting.

How it works & privacy lists exactly what is sent, when, and how to turn analytics off.

Why is it free?

Our friends and family all build with AI now. We built Dazio so the next attack skips them (and you). We believe in the power of free tools, so we’re keeping this one free.

For central management, reporting and support, Boost’s Developer Endpoint Protection adds them on top of everything Dazio does.