We are basically ingesting and analyzing every package as it gets published to the various ecosystems (currently NPM, PyPI, Rubygems, Maven and Nuget; Go and Crates support landing in beta soon).

This is currently offered as a SaaS solution, but we'll be providing an on-prem offering by EOY that should work well in an air-gapped environment.

The sandbox I mentioned above is rolled into our CLI by default, but that should operate well enough on its own without needing to call out to our API if you wanted!