fixmynpm

fixmynpm command [options]

fixmynpm is a diagnostic CLI for finding and fixing insecure or misconfigured .npmrc files. It inspects the global ~/.npmrc, walks project directories for nested .npmrc files, audits each entry against a built-in catalogue of security rules, and can apply fixes automatically. Built-in checks cover registry validation, TLS settings, authentication-token handling, lifecycle-script execution, and dependency-confusion risks.In addition to configuration hygiene, fixmynpm doubles as an incident-response tool: the scan command can recurse through node_modules to locate specific compromised packages by name, version range, or bundled-.npmrc presence, making it useful when responding to supply-chain advisories.

doctor

Inspect ~/.npmrc and report security or configuration violations with suggested fixes.

Recursively scan a directory tree, listing every .npmrc file and the issues found in each.

Apply recommended corrections to .npmrc files discovered during a scan.

Locate .npmrc files or search node_modules for specific packages (incident-response mode).

Starting directory for scan, audit, and fixer (defaults to the user's home directory).

Filter scan results to packages matching a name or glob pattern.

Filter scan results by semver range when combined with --package.

Limit scan output to packages that bundle a .npmrc file.

Enable incident-response heuristics, including bundled .npmrc detection inside node_modules.

Show planned changes without modifying any files.

Operates on .npmrc files only; it does not modify package.json, lockfiles, or installed binaries. The fixer rewrites files in place — pair it with --dry-run or version control before running broadly. Incident-response scans can be slow on large workstations because they recurse through every node_modules directory below the chosen root.

fixmynpm was created by madhugb and announced on Hacker News in 2026 following a series of npm supply-chain incidents that exposed dangerous defaults in user .npmrc files. It is written in Go and distributed via go install github.com/madhugb/fixmynpm@latest.

npm(1), npm-audit(1), yarn(1), pnpm(1)