Analyzes npm packages for vulnerabilities, malicious behavior, suspicious scripts, maintainer risk and typosquatting, without an API key.
Setup
This project documents no single launch command; follow its repository instructions.
NPMScan
NPMScanOfficial
Related
More- DdepguardmopancPre-install npm package checks: static analysis, supply-chain attack detection, vulnerability audits, hallucinated package guard and CycloneDX SBOM.Security15 Repository stars
- PProof of CommitmentpiiiicoScores supply-chain risk for npm, PyPI, Cargo and Go packages from behavioral signals such as publisher depth and release consistency.SecurityLocal + remote8 Repository stars
- SSafeDep vet MCPSafeDepOfficialVets open source packages for vulnerabilities and malicious code before agents add them to a project.Security1.1k Repository stars
- BBoost MCPBoostSecurityOfficialChecks packages a coding agent wants to add and blocks dependencies with known vulnerabilities, malware or typosquatting.Security15 Repository stars
- SMCP Security AuditqianniuspaceAudits npm package dependencies for security vulnerabilities with real-time checks against the npm registry.Security57 Repository stars
- GGuardianMCPKalvisanScans npm and Composer project dependencies for known vulnerabilities and suggests fixes.Security1 Repository stars