English Home

npm-safe Wiki

中文版首页：Home（中文）

@npm-safe is a local-first npm package security engine: it fetches package metadata from the npm registry, runs static (and optional LLM) analysis to detect supply-chain attack patterns, and caches results in a local SQLite database. v0.1.0 is feature-complete, with a CLI and a desktop GUI.

Quick start

pnpm install
pnpm -F @npm-safe/core exec tsc --noEmit   # type check
pnpm -F @npm-safe/core run build
cd packages/core && npm link               # install the CLI globally

npm-safe check lodash                       # check a package
npm-safe ci                                 # scan project deps (CI ready)

Common commands

npm-safe check <package>      # check a package's security
npm-safe search <query>       # search the npm registry
npm-safe watch add <package>  # add to the watchlist
npm-safe refresh [package]    # re-check a package
npm-safe settings set <k> <v> # read/write settings (e.g. proxy)
npm-safe rules list           # list/manage scan rules
npm-safe llm enable           # enable LLM semantic scanning
npm-safe report <pkg> ...     # export JSON/CSV reports
npm-safe gate enable          # turn on the install-time security gate
npm-safe doctor               # diagnose PATH / gate setup

Desktop application

A Neutralinojs Material You GUI (7 tabs: Overview / Check / Search / Watch / Rules / LLM / Settings) sharing check history with the CLI.

cd packages/desktop
pnpm run run     # development mode
pnpm run build   # release bundle

See the Desktop README.

Documentation

• README — full feature, command and architecture guide
• 中文版 README — 项目说明（中文）
• ARCHITECTURE — layer map, data flows, DB schema
• API — public API reference
• SCANNER_RULES — all 10 built-in scan rules

License

Apache License 2.0