npm-scan

npm-scan [package] [options]npm-scan scan-lockfile [options]

npm-scan is a CLI supply-chain security tool for the npm ecosystem. It combines static and behavioral analysis to detect attack patterns that npm audit, Snyk, and Socket often miss: obfuscated payloads, credential stealers, eBPF rootkits, memory extraction, GitHub author spoofing, AI-platform key targeting, and worm-like propagation via stolen tokens.The tool ships 23 detectors validated against real campaigns (IronWorm, Miasma, dependency confusion). It runs entirely locally with no telemetry or cloud dependency, supports policy-as-code YAML allowlists, and exports CycloneDX, SPDX, and SARIF formats. A GitHub Action is available for CI/CD integration.Free for individuals and open-source evaluation; commercial production use requires a BLA license.

scan-lockfile

Analyze dependencies in the current project lockfile.

Output findings as JSON.

Exit with non-zero status when findings meet or exceed the given severity.

Explicit scan subcommand (used with npx @lateos/npm-scan scan).

Behavioral detection may produce false positives on legitimate packages with unusual install scripts. Complement npm audit rather than replacing it — together they cover CVE databases and behavioral threats.

npm-audit(1), socket(1), snyk(1)

Source code · Homepage