@araptus/npm-security-scanner
Detect compromised npm packages in your Node.js projects.
A fast, zero-dependency CLI tool that scans your dependencies against a database of known malicious packages. Works with npm, pnpm, and yarn.
Quick Install
npx @araptus/npm-security-scanner Inspired by the 2025 npm Supply Chain Crisis
In September 2025, the Shai-Hulud npm worm—a self-replicating malware—infected 187+ packages with over 2 million weekly downloads. Combined with cryptocurrency hijacking attacks affecting packages with 2.6 billion downloads, traditional security tools failed to detect these threats quickly enough.
We built this scanner to provide instant, local detection without waiting for CVE databases to update.
What It Detects
Comprehensive protection against the latest npm supply chain threats
96+ Known Malicious Packages
Confirmed threats from npm security advisories, including the 2025 attack campaigns.
5 Major 2025 Campaigns
Shai-Hulud, PhantomRaven, Gluestick RAT, and other coordinated supply chain attacks.
Version-Specific Compromises
Only flags affected versions, not entire packages. No false positives on safe versions.
Typosquatting Variants
Common misspellings of popular packages like "lodahs", "reacct", "expresss".
Credential Theft Packages
Packages designed to steal npm tokens, API keys, and developer credentials.
Crypto Mining Malware
Hidden cryptocurrency miners embedded in innocent-looking dependencies.
Installation & Usage
Get started in seconds with zero configuration required
Quick Start
Run directly with npx (no install needed):
npx @araptus/npm-security-scannerOr install globally:
npm install -g @araptus/npm-security-scanner
npm-security-scanAdd as dev dependency:
pnpm add -D @araptus/npm-security-scannerAdd to package.json
{
"scripts": {
"security:scan": "npm-security-scan",
"security:scan:verbose": "npm-security-scan --verbose",
"security:scan:json": "npm-security-scan --json",
"security:scan:strict": "npm-security-scan --strict"
}
}CLI Options
| Option | Description |
|---|---|
| --verbose, -v | Show detailed output for each package checked |
| --json | Output results as JSON (for CI/CD parsing) |
| --strict | Exit with error code 1 on any finding |
| --quiet, -q | Minimal output, only show issues |
| --help, -h | Display help information |
Multi-Project Scanning
Scan multiple Node.js projects at once using the built-in multi-scanner:
# Scan all projects in a directory
npm-security-scan --scan-dir ~/Projects
# Or manage a project list
npm-security-scan --add-project ~/my-app
npm-security-scan --list-projects
npm-security-scan --scan-allCI/CD Integration
Automate security scanning in your deployment pipeline
GitHub Actions Example
# .github/workflows/security.yml
name: Security Scan
on:
push:
branches: [main, develop]
pull_request:
branches: [main]
schedule:
- cron: '0 9 * * 1' # Weekly Monday 9am
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
- name: Install dependencies
run: npm ci
- name: Run security scan
run: npx @araptus/npm-security-scanner --strict
- name: Generate JSON report
if: always()
run: npx @araptus/npm-security-scanner --json > security-report.json
- name: Upload security report
if: always()
uses: actions/upload-artifact@v4
with:
name: security-report
path: security-report.jsonThreat Database
Continuously updated database of known malicious packages
The threat database at security/compromised-packages.json includes:
knownMalicious.confirmed
Packages confirmed as malicious by security researchers
knownMalicious.typosquatting
Typosquatting variants of popular packages
knownMalicious.credentialTheft
Token and credential stealers
knownMalicious.cryptoMalware
Crypto mining packages
campaigns
Coordinated attack campaigns with affected versions
trustedPackages
Allowlist of known-safe packages
Update the database instantly:
Edit security/compromised-packages.json → Rerun scan No waiting for third-party database updates. Your database, your control.
Why This Scanner?
Built for speed, simplicity, and real-world threats
Zero Dependencies
Pure Node.js implementation. No external packages to worry about—no dependency inception problem.
Instant Updates
Edit a JSON file to add new threats. No waiting for CVE databases or third-party services.
Works Offline
No API calls, no rate limits, no internet required. Perfect for air-gapped environments.
Comparison with Other Tools
| Feature | This Scanner | npm audit | Snyk |
|---|---|---|---|
| Works Offline | ✓ | ✗ | ✗ |
| Zero Dependencies | ✓ | ✓ | ✗ |
| Supply Chain Attacks | ✓ | ✗ | Partial |
| Instant Database Updates | ✓ | ✗ | ✗ |
| Free Forever | ✓ | ✓ | Limited |
Protect Your Projects Today
One command. Zero configuration. Instant protection against npm supply chain attacks.
npx @araptus/npm-security-scanner 