Koidex

Key Features

• •Unified Search Across Marketplaces: Search for any software component across 15+ marketplaces including VS Code, JetBrains, npm, Hugging Face, Chrome Web Store, and more, all from a single interface. This saves time and ensures no source is overlooked when assessing risk.
• •Agentic Risk Engine: An advanced analysis system that probes the actual composition and behavior of software, going beyond mere labels to detect hidden malware, backdoors, or suspicious activities. It provides accurate, factual risk scoring.
• •Discovery Module: Continuously tracks and manages every piece of software entering your ecosystem, providing real-time inventory of all dependencies. This gives security teams complete visibility and early warning against unauthorized installations.
• •Guardrails Enforcement: Automatically blocks risky components during installation based on pre-set policies. This proactive feature prevents malicious software from ever entering the development environment, reducing human error.
• •Governance Policies: Allows teams to define custom rules for software approval, such as blocking specific categories or requiring review for certain marketplaces. This ensures consistent enforcement of security standards across the organization.
• •Remediation Actions: Provides step-by-step guidance when a risk is detected, including removal or upgrade instructions. This accelerates incident response and helps teams maintain a clean software supply chain.

Use Cases

• •Security teams can evaluate a new VS Code extension before rolling it out company-wide by searching it in Koidex, receiving a behavior-based score, and deciding to allow or block based on the analysis.
• •A developer checking an npm package before adding it to a project can use Koidex to scan for hidden dependencies and malicious code, ensuring the package is safe and preventing supply chain attacks.
• •AI researchers verifying a model from Hugging Face can run it through the Agentic Risk Engine to detect potential biases, backdoors, or data exfiltration routines, ensuring the model is trustworthy for deployment.
• •IT administrators can scan all browser extensions across enterprise devices to ensure compliance with security policies, using Koidex to identify and remediate risky add-ons from Chrome Web Store or Edge Add-ons.
• •DevOps engineers can automate risk checks for every new dependency in CI/CD pipelines, using Koidex's unified search and scoring to prevent vulnerable components from reaching production environments.

Who is this for?

Security engineers and DevSecOps professionals responsible for software supply chain security, who need to evaluate third-party components before allowing them into production. Software developers who frequently install packages, extensions, or AI models from open-source registries and want an instant safety check. IT administrators managing endpoint software across their organization, ensuring that all browser add-ons, IDE plugins, and other dependencies comply with security policies. Compliance officers who require detailed risk assessments and audit trails for software assets. Engineering managers seeking to reduce supply chain risk without slowing down development velocity. This tool is also valuable for enterprises with multiple marketplaces and custom registries.