A security-focused npm installer that protects your projects from newly compromised packages

Scan yarn/npm/pnpm lockfiles for compromised packages from the Shai-Hulud npm supply-chain attack.

Forensic scanner for Shai-Hulud 2.0 malware artifacts and compromised packages.

A CLI tool to scan GitHub Enterprise organizations for SBOMs and check for compromised packages

Universal npm supply chain attack scanner. Detects compromised packages from 12+ known attacks.

Zero-dependency CLI scanner for npm/PyPI supply chain compromises. Detects compromised packages in lockfiles and system-level IOCs from attacks like Mini Shai-Hulud (CVE-2026-45321).

Verifiable-credential supply chain compliance for npm. Sign attestations, verify dependencies, revoke compromised packages.

Security scanner that checks npm dependencies for Shai Hulud vulnerable packages. 100% offline, zero data collection, zero telemetry. Scans all dependencies against 689+ known compromised packages.

Sha1-Hulud 2.0 npm supply chain attack scanner - Real-time detection using Koi.ai data

A simple npm CLI tool (starter template)

Helpers for encoding and decoding messages according to the offchain message specification

Package filter plugin for Verdaccio that allows blocking packages by name, scope, version or date

A inter-process and inter-machine lockfile utility that works on a local or network file system

A security-focused npm installer that protects your projects from newly compromised packages

Open-source, zero-dependency tool that blocks compromised packages BEFORE download. Built to counter supply chain and credential theft attacks like Shai-Hulud.

pnpm supply-chain policy for npm maintainers — derive minimumReleaseAge exemptions and build permissions from what you publish

A deep deletion module for node (like `rm -rf`)

Client-side library to load the Paystack checkout form

AWS SDK for JavaScript Guardduty Client for Node.js, Browser and React Native

This action checks that no compromised packages are referenced in any package-lock.json files in your repository, using a list of bad versions that's fetched from a URL of your choice.