Packages and advisories

Inventory

guard packages lists the language runtimes on the device, the packages installed globally for each, the operating system's packages, and the packages that lockfiles pin in project directories you name.

guard packages                       # counts and records
guard packages --json
guard packages --root ~/src/app      # also read lockfiles below a directory
guard packages --local               # terminal output with paths

It reads the files that installers and package managers leave behind. It never runs a package manager or a runtime, and it uploads nothing.

Advisory checks

guard packages check matches the inventory against a signed snapshot of vulnerability and malicious-package advisories. It works offline, and the inventory isn't uploaded to do it.

guard packages advisories install --key advisories.pub advisories.json
guard packages check
guard packages advisories status

The snapshot comes from OSV exports, including GitHub's reviewed advisories and the OpenSSF malicious-packages reports. It carries a detached signature and an expiry time. Guard verifies it on every check and refuses an expired or tampered one.

A match shows the advisory ID, its aliases, the severity, whether the release is malicious, and the fixed version when there is one. A version Guard can't compare is reported as undetermined, never as unaffected.

In the Console

The Console shows which devices have an installed skill or plugin, and which package names hooks flagged as look-alikes or missing from the public registry. Names reach Guard Cloud only when they matched public data. See Guard Console.