When a hijacked npm package ships malware, the question is no longer whether to install it. It is whether it already reached any project on your machine. One command answers that in seconds.
$ npx depguard-cli exposure
Free and open source. Runs on your machine. Nothing about your projects leaves it.
Either nothing known is on your machine, or exactly which version is where, whether it was installed, and what to do next.
Every install leaves a record somewhere. The scan looks in the three places a malicious version can hide, and matches each exact version against the known-malicious database.
All lock files under your home directory: npm, pnpm, Yarn and Bun. Nested copies count, so a bad version buried three dependencies deep is still found.
Command-line tools you installed globally months ago and forgot about, including everything they pulled in.
Proof that a tarball was downloaded on this machine, and on which day, even if the project that asked for it is long gone.
A false alarm would mean rotating every credential you own for nothing. Every database update is tested against known-clean versions and the most popular npm packages before it ships.
The same engine as the CLI: known malware, vulnerabilities, license, maintenance and a 0 to 100 score. No install, no account.
Runs a live audit of the latest published version. Nothing is installed.
// Pick a package or type any name // Full real-time security audit, powered by the depguard engine $ depguard-cli audit ___
It downloads the tarball and reads the actual source, so a package that does something its description never mentioned gets caught. Nothing is executed.
Decoded payloads passed to eval, reverse shells, crypto miners.
CriticalEnvironment variables, SSH keys and tokens serialised and sent out.
Criticalpreinstall and postinstall scripts that download and run code.
Criticaleval, new Function and child processes where they have no business.
HighLong encoded strings and minified source hidden from reviewers.
HighA "string formatter" that opens network connections is flagged.
ExplainedOne command, no setup, no account. Point it at a folder, or let it read your whole home directory.
Every location of each malicious version, whether it is really installed, whether it runs install scripts, and when it was downloaded.
The steps scale with the evidence. If the version only sits in a lock file and never reached your disk, it says so, and you skip the credential rotation.
A few of the cases in the database, from the GitHub Advisory Database and hand-checked advisories. New ones arrive every day.
many packages4.4.210.1.710.1.11.4.10.7.293.3.6A fake job interview can send a "take-home test" that runs malware the moment VS Code opens the folder. This lists everything that would run.
npx depguard-cli audit-workspace ./test-repo
Checks that a package exists, is not a typosquat and has no known malware or vulnerabilities, then says allow, warn or block.
npx depguard-cli guard some-package
Claude Code, Cursor and other agents ask depguard the same questions through MCP, before they install anything for you.
claude mcp add depguard -- npx -y depguard-cli --mcp
Run npx depguard-cli exposure. It reads every lock file under your home directory, your global installs and the npm download cache, and reports any exact version known to be malicious, where it is, and what to rotate. On a typical developer laptop it takes about 15 seconds.
Only if a project, a global install or your npm cache holds one of the hijacked versions, such as debug 4.4.2 or color 5.0.1. The command above checks all three at once. Other versions of those packages are not affected.
No. The scan runs against a database bundled with the package. Nothing about your projects leaves your machine.
No. It only matches the exact versions listed in an advisory. Every database update is tested against known-clean versions and the most popular npm packages before it ships.
It lists every place the malicious version appears, whether it is actually installed, whether it runs install scripts and when it was downloaded, followed by the steps to take. If the version only sits in a lock file and never reached your disk, it tells you that too.
npm audit looks at one project at a time, and only at what that project's lock file lists. depguard looks at every project on the machine, the packages you installed globally and the cache of everything npm has downloaded, in a single run.
Run it now, and again the next time a worm makes the news.
$ npx depguard-cli exposure
Use it from the terminal, or connect it to your AI agent so every install is checked before it happens. No API keys, no accounts, no configuration.
One command. Zero configuration. Your AI agent starts checking every dependency immediately.
// Claude Code: one command $ claude mcp add depguard -- npx -y depguard-cli --mcp // Claude Desktop, Cursor, Windsurf, Continue.dev, Cline, Roo Code // Add to your MCP config file: { "mcpServers": { "depguard": { "command": "npx", "args": ["-y", "depguard-cli", "--mcp"] } } } // That's it. Your agent now has 15 security tools. // No API keys. No accounts. No configuration. // Or use it straight from the terminal: $ npx depguard-cli exposure $ npx depguard-cli audit express
Organised by workflow: after an incident, before opening a repo, before installing, after coding, project health, quick lookups and compliance. The agent knows when to call each one.
Answers "was this machine hit?" after a supply-chain incident. Checks every lock file, global installs and the npm download cache against the known-malicious database, with every location, install evidence and remediation steps. Exact version matches only.
After an incidentCalled after git clone and before opening the repo in any IDE. Lists every file that runs on workspace open: VS Code tasks.json runOn:folderOpen, devcontainer lifecycle commands, .envrc, JetBrains run configs, Makefile default targets, .gitattributes filter drivers, committed git hooks. Defence against fake-interview malware.
Called before every npm install, whether the user asked or the AI decided. Verifies the package exists, detects typosquatting, runs a security audit and returns allow, warn or block.
Before installWhen the AI needs functionality ("RTSP streaming", "date formatting"), it calls this before choosing a package. Checks native Node.js alternatives first, then scores npm candidates.
Before installCalled after code changes or before commit. Finds console.logs, empty catch blocks, broken imports, orphan files and abandoned TODOs. The AI fixes them before reporting done.
After codingFinds packages installed but never imported. Config-aware, workspace-aware, peer-dependency-aware. Also detects phantom dependencies in node_modules.
After codingDeep security audit of a single package. Downloads the tarball, scans source code for 18+ malware patterns, checks two advisory databases and analyses install scripts.
Project healthAudits all dependencies from a package.json in one call, at the versions in the lock file, including every installed transitive copy. Auto-detects the project license.
Project healthFaced with "100 vulnerabilities found"? Groups every vulnerable transitive under the direct dependency that pulls it in, sorted by severity weight, so you know which few bumps fix the most criticals. Read-only.
Project healthCrawls the full transitive dependency tree. Aggregates vulnerabilities across all nested packages and shows circular dependencies and the total attack surface.
Project healthQuick 0 to 100 quality score. Faster than a full audit when you only need the number. Critical vulnerabilities cap it at 30, high at 50.
Quick lookupQuick existence check plus typosquatting detection. Faster than guard when you only need to know a package name is real.
Quick lookupSearches npm by keywords, sorted by depguard quality score. Finds packages without web searches.
Quick lookupAudits several packages in one call. Use audit_project instead if you have a package.json path.
Quick lookupGenerates a CycloneDX 1.6 SBOM with PURLs, integrity hashes and optional VEX vulnerability data. Ready for EU CRA, US EO 14028, OMB M-22-18, SOC 2 and FedRAMP. Read unchanged by Dependency-Track, Trivy and Grype.
ComplianceEvery package is scored 0 to 100 across five weighted dimensions, using CVSS scores when available. A hard security ceiling applies: critical vulnerabilities cap the total at 30, high vulnerabilities at 50.
Safe to use. Meets quality standards.
Review before using. Potential risks.
Better to implement the functionality yourself.
depguard checks 20+ native alternatives before recommending npm packages. Less bloat, smaller attack surface.
Without depguard you check several sources, read scripts by hand and make gut-feel decisions. Here is what one command replaces.
| Task | depguard | Manual approach |
|---|---|---|
| Was this machine hit? | ✓ One run | Open every project, check global installs, dig through the npm cache |
| Check known CVEs | ✓ Automated | Search npm and GitHub advisories manually |
| GitHub Advisory Database | ✓ Included | Visit github.com/advisories, search, cross-reference |
| Static code analysis | ✓ 18+ patterns | Download the tarball, read the source by hand |
| Inspect install scripts | ✓ 20+ patterns | Read package source code line by line |
| Behavioural mismatch | ✓ Automated | Compare description and code behaviour yourself |
| Check maintenance health | ✓ Scored | Check the npm page, GitHub commits, last publish date |
| Verify license compatibility | ✓ 25+ SPDX | Read the LICENSE file, understand the copyleft hierarchy |
| Evaluate package quality | ✓ 0 to 100 | Subjective judgement, no consistent scoring |
| Find native alternatives | ✓ 20+ mapped | Know Node.js APIs by heart or search the docs |
| AI agent integration | ✓ 15 MCP tools | Not possible: agents install blindly |
| Time per package | ~2 seconds | 15 to 30 minutes of research |
It downloads the package tarball and scans the actual source code for malware patterns, obfuscation, data exfiltration and behaviour that does not match the description. Every finding comes with a plain explanation.
Eval of decoded payloads, reverse shells via net.connect, cryptocurrency mining pool URLs (stratum+tcp). Critical severity, blocked automatically.
CriticalJSON.stringify(process.env), Object.keys(process.env), fetch with dynamic URLs from env vars, bracket-notation env access to evade scanners.
Criticaleval(), new Function(), child_process.exec and spawn, shell interpreter spawning. Dangerous patterns are flagged with context.
HighLong hex or unicode-encoded strings, base64 payloads, minified source in non-.min.js files. Techniques used to hide malicious code from reviewers.
HighA "string formatter" that makes network calls? A "date utility" that reads the filesystem? depguard compares what a package says it does with what it actually does.
UniqueEvery finding includes severity, category, title, an explanation of why it is dangerous, the exact evidence from the source and a recommendation.
Developer-friendly// What your AI agent receives for a suspicious package: { "severity": "critical", "category": "data-exfiltration", "title": "Serialization of entire environment", "explanation": "This package serializes your ENTIRE environment into a JSON string. Your API keys, database passwords, JWT secrets would be exposed.", "evidence": "const d = JSON.stringify(process.env);", "file": "src/index.js", "recommendation": "Do NOT install this package." }
depguard statically analyses install scripts (preinstall, install, postinstall) for 20+ suspicious patterns. Each finding includes an explanation and a recommendation.
| Pattern | Severity | What it detects |
|---|---|---|
| Remote code execution | Critical | curl or wget piped to sh, download-and-execute chains |
| Credential file access | Critical | Reading ~/.ssh, ~/.aws, ~/.npmrc, ~/.gnupg, /etc/passwd |
| Sensitive env vars | Critical | Accessing $NPM_TOKEN, $AWS_SECRET, $GITHUB_TOKEN |
| Eval of decoded content | Critical | eval(atob(...)), eval(Buffer.from(..., "base64")) |
| Reverse shells | Critical | /dev/tcp connections, netcat with the -e flag |
| Shell typosquatting | Critical | /bin/ssh instead of /bin/sh |
| Process spawning | High | child_process, execSync, spawn |
| Dynamic code execution | High | eval(), exec() in install scripts |
| Obfuscated strings | High | Hex-encoded strings, base64 payloads |
| Network APIs | High | net.connect, dgram, dns.resolve in install scripts |
Major npm supply-chain incidents and how depguard detects the patterns that made them possible.
| Package | Year | Severity | What happened | depguard detection |
|---|---|---|---|---|
| debug, color and others | 2025 | Critical | Maintainer account taken over; hijacked releases such as debug 4.4.2 and color 5.0.1 shipped malware. | Advisory database matches the exact hijacked versions. exposure finds them in every project, global install and the npm cache. |
| event-stream | 2018 | Critical | Malicious dependency stole cryptocurrency wallet keys. 8M weekly downloads compromised. | Code analysis flags obfuscated code and credential access patterns. Script analysis catches eval of decoded content. |
| ua-parser-js | 2021 | Critical | Hijacked account published cryptominers and password stealers via postinstall. | Code analysis detects stratum+tcp mining URLs. Install script analysis catches process spawning and credential file access. |
| node-ipc | 2022 | Critical | Maintainer added code to wipe files based on geolocation. Dependency of vue-cli. | Behaviour mismatch: an IPC library making network calls and filesystem writes. The advisory database flags the GHSA. |
| colors + faker | 2022 | High | Maintainer sabotaged packages with infinite loops. Broke thousands of projects. | Maintenance score drops. The advisory database flags the incident. Score falls below the threshold. |
| eslint-scope | 2018 | Critical | Compromised token published a version stealing npm tokens from ~/.npmrc. | Code analysis detects credential file reads. Script analysis flags env var exfiltration. |
| coa + rc | 2021 | Critical | Hijacked accounts. Obfuscated malware in preinstall scripts. | Code analysis detects the base64 plus eval pattern. Script analysis flags obfuscated code and process spawning. |
| crossenv (typosquat) | Ongoing | High | Names mimicking popular packages. Steal environment variables on install. | Typosquatting detection via Levenshtein distance. Code analysis flags JSON.stringify(process.env). |
The highlights of each release. The complete list lives in CHANGELOG.md on GitHub.
Two follow-ups found while checking the 1.15.1 release against the live registry.
A wider review of the database, and a gate so a false positive cannot ship unnoticed again.
A new command and MCP tool for the moment after an incident, and a much larger database behind it.
depguard-cli exposure and depguard_exposure. Checks every lock file under your home directory, global installs and the npm download cache against the known-malicious database. Reports every location, whether the version is installed, whether it runs install scripts, when it was downloaded, and remediation steps that scale with the evidence. Exits 2 when exposed, so it can gate CI.audit-project now audits the installed version of each direct dependency instead of the latest published one, and checks every installed transitive copy.audit-workspace reads the per-OS tasks.json overrides used by real fake-interview campaigns.audit, audit-project and audit-workspace with --format sarif, ready for github/codeql-action/upload-sarif.depguard-cli audit-project is now a first-class CLI command, with CI-friendly exit codes.depguard_audit_workspace (MCP) and audit-workspace (CLI). The old names still work as deprecated aliases. Thanks to Konstantin Komelin for catching the inconsistency.direnv allow or build: VS Code tasks and settings, devcontainer lifecycle commands, .envrc, JetBrains run configs, the Makefile default target, .gitattributes filter drivers and committed git hooks. A defence against fake-interview malware.depguard_remediate groups every vulnerable transitive under the direct dependency that pulls it in, so the first bump is the one that fixes the most.depguard_sbom and depguard-cli sbom produce CycloneDX 1.6 documents with PURLs and integrity hashes, with optional VEX vulnerability data. Implemented natively, so depguard keeps zero runtime dependencies.Transitive scanning now covers the whole JavaScript ecosystem, plus a live security tester on depguard.dev.
Lock file parsing supports all four JS package managers: npm (package-lock.json), pnpm (pnpm-lock.yaml), Yarn classic and Berry (yarn.lock) and Bun (bun.lock).
Audit any npm package on depguard.dev with real-time results from the same engine as the CLI. No install required.
Tarball download URLs from registry metadata are validated: HTTPS only, .npmjs.org only.
Curated database of known compromised packages. event-stream, colors and faker are blocked with their full incident history.
Code analysis strips comments before scanning, so URLs in JSDoc and license headers are no longer flagged.
Code analysis findings are informational. Only CVEs and the advisory database affect the security score.
Reads package-lock.json and pnpm-lock.yaml. Transitive dependencies are no longer flagged as phantom.
Critical vulnerabilities cap the score at 30, high at 50. Compromised packages score 0.
DateTimeFormat, NumberFormat, RelativeTimeFormat and Collator detected as native alternatives.
event-stream allow (75) → block (0) colors allow (88) → score 0 faker allow → score 0
eslint 50 → 94 vue 50 → 94 fastify 30 → 93 zod 30 → 96 morgan 50 → 92
depguard downloads package tarballs and scans the source for malware patterns, obfuscation and behavioural mismatches. Every finding includes a human-readable explanation.
Extracts the JS files and scans them with 18+ rules across six threat categories: malware, data-exfiltration, code-execution, obfuscation, unexpected-behavior and supply-chain.
[CRITICAL] Serialization of entire environment JSON.stringify(process.env) in src/index.js
Compares the description and keywords with detected behaviour. A "string formatter" making network calls is flagged as unexpected-behavior.
[HIGH] Network activity inconsistent Package "date formatter" makes HTTP requests
Every finding returns severity, category, title, explanation, evidence, file path and recommendation, ready for an AI agent to show to a developer.
212 tests · 0 failures 28 new tests for code analysis
The full AI coding lifecycle: verify packages before install, audit for vulnerabilities, review the code the AI wrote, and remove unused dependencies.
depguard_guard runs before every npm install. Blocks hallucinated packages, detects typosquatting, runs a security audit.
[BLOCK] ai-made-up-pkg Package does NOT exist on npm!
depguard_audit downloads the tarball, scans the source for malware, checks two advisory databases and analyses install scripts.
[WARN] expresss Possible typosquat of: express
depguard_review finds the debris an AI agent leaves behind: console.logs, empty catch blocks, broken imports, orphan files, abandoned TODOs.
Found: 3 console.logs, 1 empty catch Fixing before commit...
depguard_sweep finds packages that were installed but never imported, with estimated size savings.
Unused: lodash (~1.4 MB) Savings: ~2.4 MB from 3 packages
The most popular npm packages, ranked by security score. Updated daily at 06:00 UTC. Alerts highlight packages that dropped in score or were flagged as dangerous.
Packages flagged as compromised or with critically low security scores. These should not be installed in any project.
| # | Package | Score | Vulns | Downloads | Trend |
|---|---|---|---|---|---|
| Loading ranking data... | |||||
Scans run automatically via GitHub Actions. Data is publicly available at /data/daily-scan.json.
Want to add a package? Open an issue.
Questions, partnerships, security reports or feedback. Reach out through any of these channels.