What it checks

Dazio does three things: it catches malware in the packages you install, including malware already on your machine, finds your exposed secrets, and flags toolchain settings worth changing. A one-time dazio scan covers all three for your home folder. dazio protect keeps checking in the background and checks installs before they land.

Malware at install

Dazio checks packages as they install, and it also finds malware that landed before you installed Dazio. Both checks run on your machine, against a local copy of the threat feed.

• Already on disk. Every scan compares the packages in your home folder with the feed: what is installed, and what your projects’ lockfiles pin. The scan needs a local feed copy. Your first dazio scan downloads one once you accept the terms. dazio feed enable keeps it updated: it takes your terms assent and your email, and requires analytics on. Updates start once you follow the emailed confirmation link. dazio protect sets up the background service, feed updates and install checks in one go.
• At install. Once installs are protected, each package is checked as your package manager downloads it, before any of its install scripts run. That covers installs your agent runs too.

Turning on install protection edits your package-manager configuration, and for some tools your shell’s PATH. Dazio lists every file before it writes one and marks each edit with how to undo it. dazio safe-pkg disable restores them all.

Coverage by ecosystem

Detected means scans find a known-malware package already on disk. Protected means installs are checked before the package lands.

Scans also list the MCP servers, AI agents (CLIs and desktop apps) and IDEs on your machine (dazio result inventory). No malware verdict is given for them.

What it does not see

Install checks cover the package managers’ normal downloads. Where they miss an install, the next scan’s on-disk check is the catch.

• Packages outside your home folder. Scans read files only under your home folder, so gems in Homebrew or system locations are not read. Global npm and pip installs are the exception, read through npm list --global and pip list, using the npm and pip first on the scan’s PATH. Background scans run in the daemon, whose login service does not take your shell’s PATH, so they can miss a Homebrew npm or pip; dazio scan --local from your shell reads them. Installs outside your home folder are still checked at install.

• A warm cache. An install served entirely from the package manager’s local cache makes no request, so there is nothing to check.

• Project-level config. A repository’s own .npmrc, pip.conf or similar file outranks your user file and can route around the check.

• Registry changes after enabling. A registry of your own set before dazio safe-pkg enable is kept and installs from it are still checked. Point a package manager at a different registry afterwards and Dazio warns and leaves it alone, unchecked, rather than overriding it.

• git and file: dependencies, and plain-http:// downloads, are not checked at install.

• Shims need a new shell. bun, poetry, pdm and pipx are covered through PATH shims, which take effect in shells started after protection is enabled.

• Network activity by install scripts is not covered.

On Windows, installs inside WSL distros are covered too: see WSL distros.

Exposed secrets

API keys in markdown files your agent wrote, tokens in shell history, forgotten .env files: Dazio finds them before malware does. It reports where each secret is, by file and line, and never its value.

Scans look in:

• .env files and shell history
• git, SSH and GitHub CLI configuration
• npm and PyPI credentials
• cloud provider, Kubernetes and Docker configuration
• infrastructure-as-code files
• JetBrains IDE settings and WireGuard configuration
• AI tools: stored credentials, chat logs, MCP server configuration and agent context files

dazio result secrets lists each finding with its file and line.

Toolchain hardening

Package managers ship with safety settings off. Dazio finds each one and shows you exactly what to change. Every finding carries a “what to change” line.

• Install cooldowns. For npm, pnpm, yarn and npm-check-updates: whether a minimum release age is set, so freshly published and possibly compromised versions are not installed at once, and whether the tool is new enough to enforce one.
• Outdated npm. npm too old for safe-by-default installs.
• pip settings. Index URLs that embed credentials, indexes or find-links over plain http://, an extra-index-url at all (a dependency-confusion risk), a trusted-host that disables TLS verification, and a pip config file holding credentials that other users can read.
• ~/.netrc readable by other users.

On Windows, the two checks for files other users can read do not apply: Windows controls access to a file with its ACL, not the permission bits these checks read. Every other check runs as it does on macOS.

IDE and agent hardening checks are in progress.

dazio result misconfig lists each finding and what to change.

WSL distros

On Windows 11, Dazio covers your WSL distros from Windows. Nothing needs to be installed inside them.

Scans. Each registered distro gets the same inventory and malware checks as Windows (packages, AI agents, skills, MCP servers, IDE extensions), plus the npm and pip settings checks. dazio scan starts a stopped distro for the scan; background scans leave it stopped and keep its last results. Results are grouped by location: this machine, then each WSL distro by name.

Docker Desktop’s distros are skipped, and so is a distro that runs its own Linux Dazio: it reports for itself.

Protection. dazio safe-pkg enable writes the same package-manager files (npm, yarn, pip, uv, cargo, RubyGems, Go modules, NuGet) under the home of each distro once it is running. A WSL2 distro needs mirrored networking to reach the check on Windows; dazio status names any distro left out. To cover it, set networkingMode=mirrored under [wsl2] in .wslconfig in your user profile, then run wsl --shutdown. Turning protection off restores each distro, and one that is not running is restored the next time it starts.

Not covered inside a distro:

• Exposed secrets are checked on Windows only.
• Shims. bun, poetry, pdm and pipx installs are not checked at install.
• Install cooldowns find npm, pnpm, yarn and npm-check-updates only on the distro’s standard PATH, so ones installed through nvm or into ~/.local/bin read as not installed.
• Freshness. A distro’s results refresh on full scans only.