Security auditing toolkit for detecting npm supply chain attacks. Detects threats that npm audit misses—URL dependencies (PhantomRaven-style attacks), malicious lifecycle scripts, typosquatting, and suspicious package metadata.
Zero npm dependencies by design: a security tool that depends on npm packages would be vulnerable to the same attacks it’s trying to detect.
Get started with npm-scanner and learn how to protect your projects.
Understand the codebase and contribute improvements.