one package
The agent fetches that exact release from the registry, unpacks it in memory, runs the seven rules and asks the public record. 5 to 20 seconds. You get the same card the wall gets, with every line. A tripped or confirmed result goes on the wall like any other catch.
a whole project
Paste or drop a package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, pyproject.toml or Pipfile. Every name is matched against the wall and the public malware record. The text is parsed in memory and dropped.
Up to 500 names per check, ten checks a minute. A clean result says nothing is on the record, which is a fact about the record, not a promise about the code.