Quickstart

Phylax helps you verify the integrity and provenance of open source and third-party artifacts so you can build and ship with confidence.

Prerequisites

• Node.js 20+ installed
• Network access to api.phyi.dev (TLS 1.2+)
• An account on the Phylax Platform

1. Install the Phylax CLI

   Install the Phylax CLI globally using npm.

   npm install -g @phyi/cli

2. Login to Phylax

   Authenticate the CLI with your Phylax account.

   phylax login

3. Verify a package

   Verify an artifact by its package reference (type/namespace/name@version).

   phylax verify package npm/express@4.18.2

4. Download an attestation

   Fetch the signed attestation for the artifact in JSON format.

   phylax attestation get pkg:npm/express@4.18.2 --json > express.sssa.json

5. Verify it offline

   Verify the attestation file offline to confirm its authenticity and integrity.

   phylax attestation verify ./express.sssa.json --offline

Sample result

A successful verification should look like this:

Verdict ALLOW The artifact is trusted.

Risk score 8/100 Low risk

Confidence 0.97 High confidence

You’ve verified your first artifact. You’re ready to go.

Next steps

• Core concepts for the vocabulary these responses use.
• Phylax CLI for the full command reference.
• Phylax API to do the same thing over HTTP, with no account.
• API reference for every endpoint and parameter.