v1.3.0: registry tokens in .npmrc

A project you did not write can ship its own .npmrc with a registry auth token. Then npm install quietly fetches a package that nobody can see on the public registry, and reading package.json shows nothing unusual. A recent fake Fiverr job hid its loader this way, behind a Tailwind plugin.

New in 1.3.0

• Checks .npmrc, .yarnrc and .yarnrc.yml anywhere in the repo (outside node_modules).
• Flags auth tokens (_authToken, _auth, _password, npmAuthToken, npmAuthIdent). The token value is never printed.
• Flags installs from a registry other than npmjs.org or yarnpkg.com, including scoped @scope:registry entries.

Example:

! frontend/.npmrc: ships a registry auth token, so the install can fetch packages the public registry does not show (token not printed)
! frontend/.npmrc: @acme packages install from another registry: https://npm.example.net/

Also since 1.2.0

• 1.2.1 scans .jsx and .tsx files, extending the TypeScript support from #4 (thanks @ayushdwivedi-stack).

Still zero dependencies, read only, no network. Self test: 41 checks on Node 18, 20 and 22.

node audit.js ./the-repo-you-were-sent