https://github.com/muthu-d-anonysm/npm2guard

Open-source tool to scan GitHub organizations for vulnerable NPM packages compromised in the September 2025 supply chain attack. Automatically analyzes nested dependency files in all repositories to help startups, freelancers, and dev teams manage supply chain risks without dedicated security experts.
https://github.com/muthu-d-anonysm/npm2guard

bugbounty bugbounty-tool cyberattack cybersecurity devsecops npm npm-module npm-package npmjs security security-audit security-tools supply-chain

Last synced: 2 months ago
JSON representation

Open-source tool to scan GitHub organizations for vulnerable NPM packages compromised in the September 2025 supply chain attack. Automatically analyzes nested dependency files in all repositories to help startups, freelancers, and dev teams manage supply chain risks without dedicated security experts.

• Host: GitHub
• URL: https://github.com/muthu-d-anonysm/npm2guard
• Owner: muthu-d-anonysm
• License: mit
• Created: 2025-09-20T17:37:46.000Z (10 months ago)
• Default Branch: main
• Last Pushed: 2025-09-20T17:52:36.000Z (10 months ago)
• Last Synced: 2025-09-20T19:26:40.554Z (10 months ago)
• Topics: bugbounty, bugbounty-tool, cyberattack, cybersecurity, devsecops, npm, npm-module, npm-package, npmjs, security, security-audit, security-tools, supply-chain
• Language: Python
• Homepage:
• Size: 16.6 KB
• Stars: 0
• Watchers: 0
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# npm2guard

![By Muthu D](https://img.shields.io/badge/author-Muthu%20D-blue)

npm2guard is a tool to scan GitHub organizations' repositories for vulnerable NPM packages affected by recent supply chain attacks. It detects compromised dependencies in `package.json`, `package-lock.json`, and `yarn.lock` files recursively.

---

## Features

- Scans all repositories within a GitHub organization.

- Detects compromised npm package versions automatically.

- Interactive GitHub token prompt with local token storage.

- Supports scanning multiple organizations from file input.

---

## Installation

Requires Python 3.6 or higher.

- git clone https://github.com/muthu-d-anonysm/npm2guard.git

- cd npm2guard

- pip install -r requirements.txt

---

## Usage

1. Scan a single organization:

  

- python scanner.py --org target

You will be prompted to enter your GitHub personal access token (recommended to use Classic tokens starting with `ghp_`).

2. Scan multiple organizations:

   

- python scanner.py --org-file targets.txt

`targets.txt` contains one organization name per line.

---

## License

MIT License — see [LICENSE](https://github.com/muthu-d-anonysm/npm2guard/LICENSE) file.

---

## Author

Muthu D.  

[LinkedIn](https://www.linkedin.com/in/anonysm)