v1.4.0: three new project config checks

Three new checks for project config files, all contributed by @Doomguy-BFG9000:

• flags .pnpmfile.cjs, a pnpm hook file that runs automatically during pnpm install (#15)
• flags a yarnPath in Yarn config that points Yarn at a binary inside the project (#17)
• flags project .npmrc settings that change how npm runs scripts: script-shell, ignore-scripts=false, node-options, init-module (#18)

GitHub Action: - uses: cryptostrapon/npm-install-audit@v1.4.0
npm: npx npm-install-audit ./repo

Full changelog: v1.3.2...v1.4.0

v1.3.2

Adds a GitHub Action, so the same check can run in a workflow before any install step.

- uses: actions/checkout@v5
- uses: cryptostrapon/npm-install-audit@v1.3.2
  with:
    path: .
    fail-on-findings: true

The step fails when anything is flagged and sets the findings output. No change to the checks. Also on npm: npx npm-install-audit ./repo.

v1.3.1: npm trusted publishing

No change to the checks.

• The package is on npm, so it runs without cloning anything: npx npm-install-audit ./repo.
• Releases are now published from GitHub Actions through npm trusted publishing (OIDC), with provenance and no stored npm token.

v1.3.0: registry tokens in .npmrc

A project you did not write can ship its own .npmrc with a registry auth token. Then npm install quietly fetches a package that nobody can see on the public registry, and reading package.json shows nothing unusual. A recent fake Fiverr job hid its loader this way, behind a Tailwind plugin.

New in 1.3.0

• Checks .npmrc, .yarnrc and .yarnrc.yml anywhere in the repo (outside node_modules).
• Flags auth tokens (_authToken, _auth, _password, npmAuthToken, npmAuthIdent). The token value is never printed.
• Flags installs from a registry other than npmjs.org or yarnpkg.com, including scoped @scope:registry entries.

Example:

! frontend/.npmrc: ships a registry auth token, so the install can fetch packages the public registry does not show (token not printed)
! frontend/.npmrc: @acme packages install from another registry: https://npm.example.net/

Also since 1.2.0

• 1.2.1 scans .jsx and .tsx files, extending the TypeScript support from #4 (thanks @ayushdwivedi-stack).

Still zero dependencies, read only, no network. Self test: 41 checks on Node 18, 20 and 22.

node audit.js ./the-repo-you-were-sent

v1.2.0

What's new

• TypeScript scanning: .ts, .mts and .cts files are now checked with the same risky-pattern rules as JS and shell files.
• --json output: findings are printed as a JSON array of { file, rule, message } objects ([] when clean), handy for CI. Exit codes are unchanged (0 clean, 1 findings, 2 bad path).
• Non-registry dependencies: package.json dependencies that bypass the npm registry are flagged: git+https, git+ssh and git:// URLs, github: / gitlab: / bitbucket: and bare user/repo shorthands, tarball and other http(s) URLs, file: and link: paths. Semver ranges, dist-tags, npm: aliases and workspace: specs are not flagged.
• README documents the new flag and checks; --version prints 1.2.0.

Thanks

Huge thanks to @ayushdwivedi-stack for the first community contribution (#4), which closed #1, #2 and #3 in one clean PR. Follow-up checks and docs in #5.

Upgrade

curl -O https://raw.githubusercontent.com/cryptostrapon/npm-install-audit/v1.2.0/audit.js
node audit.js --json ./take-home-task

A clean result is still not proof of safety. Read the code and open unknown repos in a throwaway container or VM.