Trustefi Customs now covers PyPI, npm, Maven, NuGet and more.See how it works
Trustefi Trustefi
ENEnglishDEDeutschFRFrançaisNLNederlandsESEspañolITItalianoPLPolskiSVSvenskaNONorskDADanskFISuomi
Book a demo
Product

Every open source package cleared before it enters your code.

Trustefi Customs is a secure gateway between public registries and your teams. It inspects every package, stops what doesn't belong and records what got through.

Book a demoHow Customs works

Every ecosystem, one gateway

Customs works with the registries your teams already use, from Python and JavaScript to Java, .NET, Go, Rust and container images.

PythonPyPI
JavaScriptnpm
JavaMaven Central
.NETNuGet
GoGo modules
Rustcrates.io
RubyRubyGems
ContainersBase images

How Customs works

01

Connect

Point pip, npm, Maven and the rest at Customs. Developers keep working as before.

02

Inspect

Inspector checks every package for malware, typosquats and known vulnerabilities.

03

Decide

Safe packages are cleared. Risky ones are stopped, and your team is told why.

04

Record

Manifest keeps a full record of what entered every build.

Built in from day one

  • Inspector

    AI inspection catches malicious, typosquatted and vulnerable packages before they are installed.

  • Night Watch

    Fixes prepared overnight, waiting for your approval in the morning.

  • Manifest

    A software bill of materials for every build, ready for the Cyber Resilience Act.

  • Policy Control

    Set rules once, such as licences, package age or blocked publishers, and Customs enforces them everywhere.

What Inspector checks

Typosquatting

Names that imitate popular packages.

Malicious code

Install scripts, obfuscation and unexpected network calls.

Known vulnerabilities

Published CVEs matched to exact versions.

Publisher changes

New maintainers, hijacked accounts and sudden ownership transfers.

Provenance

Signed builds and a verifiable source.

Licence policy

Licences that conflict with how you ship software.

Designed to sit quietly in your stack

Trustefi checks what enters your environment before your developers, scanners or auditors ever see it.

Choose how fast we act

Every Customs plan includes inspection, blocking and Manifest. Higher plans add faster human follow-up.

Watch

Automatic inspection and blocking, with alerts to your team.

Guard

Faster review of findings and guidance from our engineers.

Fortress

Immediate action on serious findings, with direct follow-up.

Frequently asked questions

Which ecosystems does Customs support?
Python (PyPI), JavaScript and TypeScript (npm), Java and Kotlin (Maven Central), .NET (NuGet), Go modules, Rust (crates.io), Ruby (RubyGems) and container base images. Teams that work in several languages connect each package manager to the same Customs gateway, so one set of policies covers everything.
What happens when a package is stopped?
The install fails with a clear reason, such as a likely typosquat or a critical vulnerability. Your team is alerted, the event is logged for audit, and Night Watch suggests a safe alternative or a fixed version where one exists. Your security team can review the decision and approve an exception when there is a good reason.
Does Customs replace our existing scanners?
No, it works before them. Scanners usually find problems after code has already been installed or shipped. Customs stops risky packages at the door, so your scanners report fewer findings and your teams spend less time on clean-up. Manifest also gives your scanners and auditors a reliable record of every dependency.
Will Customs slow down our builds?
Approved packages are cached, so repeat installs are often faster than going to the public registry directly. New packages are inspected the first time they are requested, and most checks complete in seconds. Caching also makes your builds less dependent on external registries being available.
How does Night Watch decide on fixes?
Night Watch looks for the smallest safe change, such as a patch version that removes a vulnerability, and checks that it does not introduce new risks. It prepares the change as a pull request or merge request for review. Nothing is merged automatically, so your team stays in control of every change.
How does Customs help with the Cyber Resilience Act?
The CRA expects manufacturers to know which components are in their products and to report actively exploited vulnerabilities quickly. Manifest produces a software bill of materials for every build, and Inspector flags affected versions as soon as new vulnerabilities are published. Together they give you the record and the early warning the regulation asks for.

See Customs on your own stack.

We'll connect a test project and show you what Customs would have stopped.

Book a demo[email protected]