Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/js-kyle/npm-viewscripts
Identify potentially malicious npm scripts in a project.
https://github.com/js-kyle/npm-viewscripts
Last synced: 3 months ago
JSON representation
Identify potentially malicious npm scripts in a project.
- Host: GitHub
- URL: https://github.com/js-kyle/npm-viewscripts
- Owner: js-kyle
- License: mit
- Created: 2019-08-25T04:36:12.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2023-01-09T05:02:43.000Z (almost 2 years ago)
- Last Synced: 2024-10-10T08:13:05.284Z (3 months ago)
- Language: JavaScript
- Homepage: https://www.npmjs.com/package/npm-viewscripts
- Size: 405 KB
- Stars: 9
- Watchers: 2
- Forks: 2
- Open Issues: 4
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
npm-viewscripts
Identify potentially malicious npm scripts in a project.
## Overview
This project is a Node.js CLI tool to identify which of a project's existing dependencies are utilising npm lifecycle scripts, which _could_ be malicious.
The currently configured npm scripts the tool will identify are:
`preinstall`, `postintall`, `preuninstall`, `postuninstall`
**Note: This project is to educate, so should not be used as a complete npm security solution.**
## Installation
```
# install globally, using npm
$ npm install npm-viewscripts -g
# Run the cli on a project
$ cd my-node-project
$ npm install
$ npm-viewscripts
```
## Usage
```
$ npm-viewscripts
Usage
$ npm-viewscripts [path]
Options
path Modules folder [Default: node_modules]
```
## Understanding the result
Positive report example:
```
Potentially unsafe scripts found. These should be reviewed for safety
Module name: monorepo-symlink-test Type: postinstall
```
The above output informs us that the `monorepo-symlink-test` is running a `postinstall` script, so we should review that, and ensure that it is safe.
Negative report example:
```
No potentially unsafe scripts found.
```
No modules in the project are _currently_ using scripts which could be used maliciously.