{"id":16795381,"url":"https://github.com/js-kyle/npm-viewscripts","last_synced_at":"2025-04-11T00:03:12.091Z","repository":{"id":44078812,"uuid":"204246413","full_name":"js-kyle/npm-viewscripts","owner":"js-kyle","description":"Identify potentially malicious npm scripts in a project.","archived":false,"fork":false,"pushed_at":"2023-01-09T05:02:43.000Z","size":415,"stargazers_count":9,"open_issues_count":4,"forks_count":2,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-28T22:09:02.353Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://www.npmjs.com/package/npm-viewscripts","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/js-kyle.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-08-25T04:36:12.000Z","updated_at":"2022-08-28T03:47:39.000Z","dependencies_parsed_at":"2023-02-08T08:46:50.365Z","dependency_job_id":null,"html_url":"https://github.com/js-kyle/npm-viewscripts","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-kyle%2Fnpm-viewscripts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-kyle%2Fnpm-viewscripts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-kyle%2Fnpm-viewscripts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/js-kyle%2Fnpm-viewscripts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/js-kyle","download_url":"https://codeload.github.com/js-kyle/npm-viewscripts/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247878018,"owners_count":21011158,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T09:16:11.853Z","updated_at":"2025-04-11T00:03:12.022Z","avatar_url":"https://github.com/js-kyle.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n\u003ch1 align=\"center\"\u003e\n  \u003cbr\u003e\n  npm-viewscripts\n  \u003cbr\u003e\n\u003c/h1\u003e\n\n\u003ch4 align=\"center\"\u003eIdentify potentially malicious npm scripts in a project.\u003c/h4\u003e\n\u003cp align=\"center\"\u003e\n    \u003cimg alt=\"GitHub\" src=\"https://img.shields.io/github/license/js-kyle/npm-viewscripts.svg\"\u003e\n    \u003cimg alt=\"NPM\" src=\"https://img.shields.io/npm/v/npm-viewscripts.svg\"\u003e\n\u003c/p\u003e\n\n\n## Overview\n\nThis project is a Node.js CLI tool to identify which of a project's existing dependencies are utilising npm lifecycle scripts, which _could_ be malicious.\n\nThe currently configured npm scripts the tool will identify are:\n`preinstall`, `postintall`, `preuninstall`, `postuninstall`\n\n**Note: This project is to educate, so should not be used as a complete npm security solution.**\n\n## Installation\n\n```\n# install globally, using npm\n$ npm install npm-viewscripts -g\n\n# Run the cli on a project\n$ cd my-node-project\n$ npm install\n$ npm-viewscripts\n```\n\n## Usage\n\n```\n$ npm-viewscripts\n\n  Usage\n    $ npm-viewscripts [path]\n\n  Options\n    path  Modules folder  [Default: node_modules]\n```\n\n## Understanding the result\nPositive report example:\n```\nPotentially unsafe scripts found. These should be reviewed for safety\nModule name: monorepo-symlink-test Type: postinstall\n```\nThe above output informs us that the `monorepo-symlink-test` is running a `postinstall` script, so we should review that, and ensure that it is safe.\n\nNegative report example:\n```\nNo potentially unsafe scripts found.\n```\nNo modules in the project are _currently_ using scripts which could be used maliciously.\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjs-kyle%2Fnpm-viewscripts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjs-kyle%2Fnpm-viewscripts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjs-kyle%2Fnpm-viewscripts/lists"}