Gathering detailed insights and metrics for npq
Gathering detailed insights and metrics for npq
Gathering detailed insights and metrics for npq
Gathering detailed insights and metrics for npq
🎖safely* install packages with npm or yarn by auditing them as part of your install process
npm install npq
Typescript
Module System
Min. Node Version
Node Version
NPM Version
54.1
Supply Chain
95.1
Quality
81.5
Maintenance
100
Vulnerability
96.4
License
Updated on 03 Dec 2024
JavaScript (99.63%)
Shell (0.37%)
Cumulative downloads
Total Downloads
Last day
41.6%
Compared to previous day
Last week
-25%
Compared to previous week
Last month
8%
Compared to previous month
Last year
195%
Compared to previous year
safely* install packages with npm/yarn by auditing them as part of your install process
Media coverage about npq:
Once npq is installed, you can safely* install packages:
1npq install express
npq
will perform the following steps to sanity check that the package is safe by employing syntactic heuristics and querying a CVE database:
If npq is prompted to continue with the install, it simply hands over the actual package install job to the package manager (npm by default).
safely* - there's no guaranteed safety; a malicious or vulnerable package could still exist that has no security vulnerabilities publicly disclosed and passes npq's checks.
1npm install -g npq
Note: we recommend installing with npm
rather than yarn
. That way, npq
can automatically install shell aliases for you.
1npq install express
Since npq
is a pre-step to ensure that the npm package you're installing is safe, you can safely embed it in your day-to-day npm
usage so there's no need to remember to run npq
explicitly.
1alias npm='npq-hero'
If you're using yarn
, or generally want to explicitly tell npq which package manager to use you can specify an environment variable: NPQ_PKG_MGR=yarn
Example: create an alias with yarn as the package manager:
1alias yarn="NPQ_PKG_MGR=yarn npq-hero"
Note: npq
by default will offload all commands and their arguments to the npm
package manager after it finished its due-diligence for the respective packages.
Marshall Name | Description | Notes |
---|---|---|
age | Will show a warning for a package if its age on npm is less than 22 days | Checks a package creation date, not a specific version |
author | Will show a warning if a package has been found without an author field | Checks the latest version for an author |
downloads | Will show a warning for a package if its download count in the last month is less than 20 | |
readme | Will show a warning if a package has no README or it has been detected as a security placeholder package by npm staff | |
repo | Will show a warning if a package has been found without a valid and working repository URL | Checks the latest version for a repository URL |
scripts | Will show a warning if a package has a pre/post install script which could potentially be malicious | |
snyk | Will show a warning if a package has been found with vulnerabilities in Snyk's database | For Snyk to work you need to either have the snyk npm package installed with a valid api token, or make the token available in the SNYK_TOKEN environment variable, and npq will use it |
license | Will show a warning if a package has been found without a license field | Checks the latest version for a license |
expired domains | Will show a warning if a package has been found with one of its maintainers having an email address that includes an expired domain | Checks a dependency version for a maintainer with an expired domain |
signatures | Will compare the package's signature as it shows on the registry's pakument with the keys published on the npmjs.com registry | |
provenance | Will verify the package's attestations of provenance metadata for the published package |
To disable a marshall altogether, set an environment variable using with the marshall's shortname.
Example, to disable the Snyk vulnerability marshall:
MARSHALL_DISABLE_SNYK=1 npq install express
1npq install express --dry-run
Learn Node.js Secure Coding techniques and best practices from Liran Tal
npm install
will install a module even if it has vulnerabilities; NPQ will display the issues detected, and prompt the user for confirmation on whether to proceed installing it.pre-install
script which can be potentially harmful for your system and prompt you whether to install it. Whereas npm audit
will not perform any such checks, and only consults a vulnerability database for known security issues.npm audit
is closer in functionality to what Snyk does, rather than what NPQ does.Please consult the CONTRIBUTING for guidelines on contributing to this project
Liran Tal liran.tal@gmail.com
No vulnerabilities found.
Reason
security policy file detected
Details
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
Reason
packaging workflow detected
Details
Reason
dependency not pinned by hash detected -- score normalized to 4
Details
Reason
3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Reason
8 existing vulnerabilities detected
Details
Reason
Found 0/29 approved changesets -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
project is not fuzzed
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Score
Last Scanned on 2024-12-02
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More