v1.0.0
@npm-safe v1.0.0 — npm Package Supply-Chain Security Engine
The first stable release of @npm-safe, a local-first engine for analyzing npm packages against known supply-chain attack patterns.
Features
- Static analysis engine — 10 built-in rules detecting install-script abuse, code obfuscation, base64 shell payloads, typosquatting, exposed secrets, homograph attacks, and more.
- Multi-provider LLM scan — optional semantic analysis via OpenAI, Google Gemini, or Anthropic Claude, with strict response validation and score fusion (60% static / 40% semantic).
- CLI (
npm-safe) — 15 commands: check, search, watch, refresh, settings, lang, rules, llm, ci, report, telemetry, gate, install, doctor, skill. JSON output, proxy support, structured command log (JSONL). - Install-time security gate — opt-in, default-off. Intercepts npm/pnpm/yarn installs, checks every package, supports shell wrappers and Windows PATH shims.
- Desktop GUI — Neutralinojs app with a Material You dashboard (overview, check, search, watch, rules, LLM, settings), light/dark themes, persistent check history, and built-in auto-update.
- Agent skill —
npm-safe-scanskill for AI agents; offered on install and manageable vianpm-safe skill install|status|uninstall. - Plugin system — dynamic third-party scan rules from
~/.npm-safe/rules/. - CI/CD — dependency scan (
npm-safe ci), GitHub Actions CI + publish workflows with SLSA provenance. - Extras — batch operations, report export (JSON/CSV), opt-in local telemetry, shared CLI/GUI check history, structured command logs.
Security
- All desktop GUI output is HTML-escaped (previous XSS-to-RCE fixes verified).
- No shell injection in the install gate (argv-based child processes only).
- Telemetry is opt-in and local-only (no network).
Compatibility
- Node.js 18+ (global fetch required)
- Windows / macOS / Linux (desktop GUI requires a WebView2/WebKit runtime)
Install
npm install -g @npm-safe/coreOr use as a library:
npm install @npm-safe/core