np-audit — Zero-dependency static analyzer that catches…
0 reactions
np-audit — Zero-dependency static analyzer that catches malicious npm lifecycle scripts before they execute
After the recent wave of npm supply chain attacks (event-stream, ua-parser-js, colors/faker, the SAP CAP incident in 2025), I built this CLI tool that statically analyzes npm package lifecycle scripts *before* they run.
**The problem:** When you run `npm install`, preinstall/install/postinstall scripts execute automatically with full system access. Attackers hide payloads behind obfuscation, hex escapes, `eval()`, and encoded strings.
**What np-audit does:**
- Downloads tarballs and inspects lifecycle scripts without executing them
- 14+ detection modules: obfuscation patterns, high-entropy strings, dynamic code execution, network calls, credential access, and more
- Walks `require()`/`import` graphs to follow hidden payloads across files
- CVE scanning via OSV.dev (free) or Snyk
- Drop-in replacement for `npm install` / `npm ci` — just use `npa install`
- Zero production dependencies, pure Node.js built-ins, under 100 kB
- Interactive `--review` mode to selectively allow/deny scripts
Would love feedback from the community — especially on detection patterns I might be missing.
#dev #js #programming #technology
After the recent wave of npm supply chain attacks (event-stream, ua-parser-js, colors/faker, the SAP CAP incident in 2025), I built this CLI tool that statically analyzes npm package lifecycle scripts *before* they run.
**The problem:** When you run `npm install`, preinstall/install/postinstall scripts execute automatically with full system access. Attackers hide payloads behind obfuscation, hex escapes, `eval()`, and encoded strings.
**What np-audit does:**
- Downloads tarballs and inspects lifecycle scripts without executing them
- 14+ detection modules: obfuscation patterns, high-entropy strings, dynamic code execution, network calls, credential access, and more
- Walks `require()`/`import` graphs to follow hidden payloads across files
- CVE scanning via OSV.dev (free) or Snyk
- Drop-in replacement for `npm install` / `npm ci` — just use `npa install`
- Zero production dependencies, pure Node.js built-ins, under 100 kB
- Interactive `--review` mode to selectively allow/deny scripts
Would love feedback from the community — especially on detection patterns I might be missing.
#dev #js #programming #technology
| 3,000 mlx | |
| 3 | |
| 0 |