Stop guessing which dependency will bite you.
Scan any repository and see exactly which of your services resolve a compromised version, and when you were exposed.
Powered by
GET /api/investigate/npm/lodash/4.17.20
contacting HydraDB…
Blast radius in seconds
Paste any repository and see exactly which of your services resolve a compromised version, through a transitive reverse-dependency closure.
Transitive exposure paths
The exact repository to lockfile to package chain that leads back to the bad version, not just a package list.
Time travel
Which applications resolved the compromised version while the advisory was live? Replay the graph as-of any date.
Worm-speed simulation
Compromised at 09:00, know which services are exposed by 09:06 with per-hop propagation timing.
Live watch
Poll OSV for every scanned version and get first-seen alerts, each with its exposure path.
Proven fixes
The fewest upgrades that clear the blast radius, each verified by re-traversing HydraDB.
“The moral is obvious. You can't trust code that you did not totally create yourself. No amount of source-level verification or scrutiny will protect you from using untrusted code.”
Reflections on Trusting Trust, 1984 Turing Award Lecture
Sounds relatable?
Scan a repositoryFAQ
Common questions
Ask AI
Still not sure?
Don't just take our word for it. See what your favorite AI says about actik.
Catch the next worm before it spreads.
Scan any repository and know exactly which of your services are exposed, the moment a package is compromised.
Scan a repository