Terms
The malpack End User License Agreement.
Last updated: 2026-10-05
This End User License Agreement ("Agreement") is between you and Halioc, Inc. ("Licensor") and governs your installation and use of the malpack desktop application, including any updates delivered to it (the "Software"). By installing or using the Software, you agree to this Agreement. If you do not agree, do not install or use the Software.
1. License grant
Licensor grants you a non-exclusive, non-transferable, revocable license to install and use the Software, in binary form only, on devices you own or control, subject to the tier you hold under Section 2:
(a) Evaluation. Without a subscription, you may use the Software for fourteen (14) days from first launch, including within a company or other organization, to evaluate it. If Licensor invited you to test the Software before its general release, your evaluation period for the builds Licensor distributed to you is ninety (90) days from first launch.
(b) Subscription. With an active subscription, you may use the Software for any purpose, including commercial and production use, for the number of seats and with the features your tier includes, for as long as the subscription remains active.
A seat is one named individual. A seat covers that individual's use of the Software on the number of devices their tier allows, and, in tiers that report findings to Licensor's service, the reporting of that individual's findings however they are produced. Seats may be reassigned when a person leaves; they may not be shared.
2. Subscriptions and tiers
Tiers. Licensor offers the Software in the tiers described on Licensor's pricing page at halioc.com at the time of purchase: Solo, Pro, Team and Enterprise. The features, device limits, seat counts and managed-AI allowance of each tier are as described there on the date of your order and are incorporated into this Agreement. Licensor may add features to a tier at any time and will not remove features from a tier during a paid term.
Term and renewal. Subscriptions run for the term selected at purchase (monthly or annual) and renew automatically until cancelled. Cancellation takes effect at the end of the current term; the license continues until then.
Payment and refunds. Purchases are processed by Licensor's reseller and merchant of record, identified at the point of purchase, whose terms govern payment, taxes and invoicing. Refunds are available as described in Licensor's refund policy at halioc.com/legal/refunds, in addition to any rights the law gives you.
Managed AI. Tiers that include managed AI features do so under a monthly allowance stated for the tier. When the allowance is exhausted, those features pause until the next month or, where your tier allows it, until you connect your own AI provider; scanning never stops.
Account. Subscriptions require an account. Section 7 describes what the account and the service collect.
Team and Enterprise. A Team or Enterprise subscription is held by the organization. Its administrators may assign and reassign seats, set organization policy, and view findings reported by seated individuals. Enterprise subscriptions may be governed by a separate signed order form or agreement, which controls over this Agreement where they conflict.
Lapse. If a subscription lapses, the Software reverts to the evaluation terms in Section 1(a) if any evaluation period remains, and otherwise to scanning only, with no managed features, until renewed. Findings already produced remain yours.
3. Restrictions
You may not: (a) distribute, sell, rent, lease, sublicense, publish, or host the Software; (b) modify, translate, or create derivative works of the Software; (c) reverse engineer, decompile, or disassemble the Software, except to the extent applicable law expressly permits despite this limitation; or (d) remove or alter any proprietary notices in the Software.
These restrictions apply to the Software as distributed, and only to it. The Software includes components licensed under the Apache License 2.0 and other open-source licences. Nothing in this Agreement limits, supersedes, or removes any right granted to you by those licences in respect of those components. Where this Agreement and an open-source licence conflict as to a component, that licence governs for that component. The Software's About panel lists those components and their licences.
4. Ownership
The Software is licensed, not sold. Licensor retains all right, title, and interest in and to the Software, including all intellectual property rights.
5. Third-party components
The Software includes third-party open-source components that are licensed under their own terms, which govern those components. A component inventory (CycloneDX SBOM) is attached to each release.
6. Updates
The Software may check for, download, and install updates. Updates are governed by this Agreement unless they are accompanied by different terms.
7. Privacy
Scans run locally on your machine. To perform detection, the Software queries public package-registry, vulnerability-advisory and package-reputation services with package names and versions, and downloads threat-intelligence data and updates as files. It does not transmit your source code or the contents of your files. Without a subscription it contains no telemetry, requires no account, and sends nothing to Licensor.
With a Solo or Pro subscription, Licensor's service receives your account details, your plan and its status, and, for each device you activate, a device name and identifier, its operating system and the Software's version, which the Software sends again when it renews its license. It does not receive your scan findings, the list of packages you have installed, or the contents of your source code or packages. Where a tier includes managed AI, the data described in item 1 below is sent through Licensor's service to the AI provider under Licensor's account instead of your own. With a Team or Enterprise subscription, Licensor's service also receives seat assignments and the scan findings your seats report, for the purpose of central reporting and organization policy. Licensor's privacy policy at halioc.com/legal/privacy describes this in full. The free command-line tool, licensed separately under Apache-2.0, contacts no Licensor endpoint.
Two features are optional. Both are off unless you turn them on with your own credentials, and both send data to a third party under your own account and that party's terms, not to Licensor:
- Your own AI provider. If you supply your own key for Anthropic, or connect another AI provider of your choice, the Software sends that provider the package name, version and ecosystem, the finding type and its category, the severity or confidence, the dependency depth, and the text of the finding, in order to explain the finding or assess whether it is a false positive. The install path is not transmitted, and home-directory paths are removed from the finding text. No file contents and no source code are sent. A provider running on your own machine receives the same data, and it does not leave the machine.
- GitHub repository scanning. If you supply your own GitHub token, the Software reads dependency manifests and workflow files from the repositories you select, in order to scan them.
8. Termination
This Agreement terminates automatically if you breach it. Upon termination, you must stop using the Software and delete all copies.
9. Disclaimer of warranty
THE SOFTWARE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL DETECT ALL MALICIOUS PACKAGES, VULNERABILITIES, OR OTHER THREATS, OR THAT ITS FINDINGS WILL BE FREE OF FALSE POSITIVES. THE SOFTWARE IS AN AID TO, NOT A SUBSTITUTE FOR, YOUR OWN SECURITY PRACTICES.
10. Limitation of liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, LICENSOR SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, OR ANY LOSS OF DATA, PROFITS, OR BUSINESS, ARISING OUT OF OR RELATED TO THIS AGREEMENT OR THE SOFTWARE. LICENSOR'S TOTAL AGGREGATE LIABILITY SHALL NOT EXCEED THE AMOUNTS YOU PAID FOR THE SOFTWARE IN THE TWELVE MONTHS PRECEDING THE CLAIM, OR TEN U.S. DOLLARS IF YOU PAID NOTHING.
11. Changes to this Agreement
Licensor may modify this Agreement for future versions of the Software. The version of this Agreement accompanying your copy of the Software applies to that copy.
12. Open-source components
The Software includes the malpack detection engine (malpack-core), Copyright (c) 2026 Halioc, Inc., which is licensed under the Apache License, Version 2.0 (the "Apache License"). A copy of the Apache License is available at http://www.apache.org/licenses/LICENSE-2.0 and, together with the associated attribution notices, in the Software's About panel. Nothing in this Agreement limits any rights you have under the Apache License to the components it covers, as obtained from their public source; this Agreement governs the Software as distributed.
13. General
This Agreement is the entire agreement between you and Licensor regarding the Software. It is governed by the laws of the State of Delaware, USA, without regard to conflict of laws principles. If any provision is held unenforceable, the remainder stays in effect. Licensor's rights under this Agreement may be assigned, including to a successor entity.