FAQ & Troubleshooting

Answers to common questions and solutions to known issues. If you can't find what you're looking for here, reach out to us directly.

Frequently asked questions

What package ecosystems does Ossprey support?

npm (JavaScript) and PyPI (Python). Within those, the CLI reads the manifests and lockfiles of the common package managers — npm, yarn, pnpm, pip, Poetry, uv, PDM — so yarn.lock and poetry.lock projects are covered even though the ecosystems themselves are npm and PyPI. If you need support for additional ecosystems, please contact us at [email protected].

How often are repositories scanned?

Repositories connected via the GitHub App are scanned on pull requests against the monitored branch, and on a nightly or weekly schedule you configure per repository (or not at all, if you turn the schedule off). You can also trigger manual scans from the dashboard at any time.

Can I scan private repositories?

Yes. The Ossprey GitHub App requests only the permissions needed to read package manifests. It accesses your repository content to generate SBOMs, but never stores your source code. Private repositories are fully supported.

What happens when a malicious package is detected?

The finding is flagged on the dashboard with a threat card explaining why. If you have an alert rule set up, it's delivered to your email, Slack channel, or incident.io workspace — see Notifications & Alerts. In CI, the CLI exits with code 1 to fail your pipeline; if you run installs through the CLI's package-manager forwarder, the install is blocked outright. You should investigate the flagged package, check for a safe version or alternative, update your project, and re-scan.

What if a package I already use is flagged later?

Ossprey notifies you. Detection improves continuously, so a package that scanned clean last month may be identified as malicious later — you don't have to re-run a scan to find that out.

Is my code secure?

Ossprey reads your repository to analyse package manifests and generate SBOMs, but never stores your source code. For public repositories you can additionally opt into scanning the repository's own code; that analysis is also not stored. All data is encrypted in transit and at rest.

How does Ossprey detect threats?

Ossprey performs live, real-time analysis of packages by examining their code and behaviour. This includes behavioural analysis to understand what a package actually does at runtime, combined with our threat intelligence. Findings are mapped to MITRE ATT&CK techniques and Ossprey's own TTP taxonomy so you can see how a package operates, not just that it was flagged.

What are my scan limits?

Your plan sets a daily and monthly package quota, both visible in Account settings. Exceeding a quota does not fail your build — the API skips the scan and the CLI exits 0 with a message telling you when the quota resets. API submissions return 429. Packages Ossprey can resolve from cache or by reputation aren't charged against your quota.

I think a finding is wrong. What do I do?

Use Report False Positive on the finding's status dropdown. That sets its status immediately and sends the report to our analysts, who come back with Investigating, Not Malicious, or Malicious. For a suspected false negative — a malicious package we marked safe — report it from the Artifact Caches view or email support with the package name, version, and ecosystem. See Triaging findings.

How do I contact support?

Email us at [email protected], or use the in-app support option in the dashboard.

Troubleshooting

My scan is stuck or not completing

Large projects with many dependencies take longer to scan. If a scan seems stuck for more than 30 minutes, try refreshing the page or running a new scan. If the problem persists, contact support.

The GitHub integration isn't triggering scans

Confirm the repository is enabled in Monitoring (reached from the GitHub Integrations page — it isn't a top-level sidebar item), and that pull request scanning is switched on if that's what you're expecting
Go to GitHub Settings → Applications → Installed GitHub Apps
Find Ossprey and click Configure
Verify repository access permissions
Check webhook delivery in your GitHub repo settings under Webhooks
Try uninstalling and reinstalling the app
Ensure your organisation allows third-party apps

I'm getting unexpected scan results

Ensure you're looking at the correct branch/version — a repository can be monitored on several branches, and the Scan Results table has an inline branch dropdown
Check the scan date — results may be from an older scan
Check whether the result reads Warning or Skipped: the scan completed but some components couldn't be analysed. The component list shows exactly which ones, marked Not found or Unsupported
Verify your package manifest files are correct and up to date
If your project uses unpinned version ranges with no lockfile, the CLI resolves those to the latest published version, so results can shift as registries publish. Commit a lockfile, or pass --no-version-lookup, for a stable catalogue
To report a false positive or false negative, see I think a finding is wrong

My scan count looks low / packages are missing

A manifest with no lockfile yields direct dependencies only. Commit a lockfile for full transitive coverage
Vendored trees (anything under node_modules/) are deliberately skipped — Ossprey catalogues what your manifests declare
Packages defined locally in your own project are flagged as local rather than looked up in a registry

CLI authentication errors

Check that your API key is correctly set via --api-key or the OSSPREY_API_KEY environment variable (a bare API_KEY also works as a legacy fallback)
Confirm the key looks right — Ossprey keys start with ospy_
Check the key hasn't expired. Every key has a mandatory expiry date; the API Keys table shows Expired once it's past
Verify the key hasn't been revoked in the dashboard
Ensure you're not accidentally using a dry-run flag (which bypasses auth but doesn't submit to the API)
Try regenerating a new key in the API Keys section of Account settings

I can't log in

Clear your browser cache and cookies
Try a different browser
Check that you're using the correct email/account
Try the "Forgot Password" flow
If using SSO, contact your IT administrator

The dashboard is loading slowly

Refresh the page
Check your internet connection
Clear browser cache
Try a different browser

Contact support

If you can't find an answer above:

Email: [email protected]
In-app support: Use the support option in the dashboard

When contacting support, please include your account email, a description of the issue, steps to reproduce the problem, and any error messages or screenshots.