Catch risky npm dependency changes before they merge.
-
Updated
Nov 9, 2026 - TypeScript
#
npm-security
Here are 81 public repositories matching this topic...
GitHub Action that detects the Shai-Hulud 2.0 (Nov 2025) and ChainDrop (Aug 2026) npm supply-chain attacks. Scans dependencies, lockfiles and CI workflows against a daily-updated database of 1,200+ compromised packages, flags malicious install scripts, TruffleHog secret theft and SHA1HULUD runners. SARIF output for GitHub Code Scanning.
nodejs npm security ioc sarif devsecops code-scanning malware-detection threat-detection credential-theft github-actions github-action dependency-scanning open-source-security supply-chain-security npm-security shai-hulud supply-chain-attack chaindrop shai-hulud-2
-
Updated
Nov 9, 2026 - TypeScript
macOS Seatbelt sandbox CLI for developers. Protect credentials (SSH, AWS, GPG) from malicious npm packages, supply chain attacks, and untrusted build scripts. Deny-by-default filesystem isolation. Perfect for Claude Code agentic workflows with --dangerously-skip-permissions.
macos shell rust cli security terminal sandbox developer-tools seatbelt supply-chain-security sandbox-exec credential-protection agentic-ai claude-code npm-security
-
Updated
Oct 12, 2026 - Rust
A Git-native dependency admission controller. Evaluates trust signals on every dependency change and blocks commits or builds when packages fail your team's policy. Pre-commit hook + CI gate with built-in approval workflow.
cli opensource devtools ci-cd provenance git-hooks lockfile dependency-management admission-controller slsa supply-chain-security npm-security
-
Updated
Apr 18, 2026 - JavaScript
Why Claude Code leaked: a deep dive into npm packaging failures, source map exposure, and modern supply chain security risks.
npm ci-cd source-map devsecops vulnerability-analysis cloud-security security-research security-best-practices r2-storage claude-code npm-security claude-code-leaked claude-code-leak claw-code packaging-security
-
Updated
Apr 4, 2026 - JavaScript
Was I hit by an npm supply-chain attack? Scan every lock file, global install and the npm cache for known-malicious package versions. Pre-install guard, pre-open repo audit, MCP server.
cli npm security typescript mcp incident-response vscode cursor lockfile devsecops ai-agents malware-detection sbom cyclonedx dependency-security supply-chain-security mcp-server claude-code npm-security shai-hulud
-
Updated
Nov 9, 2026 - TypeScript
Safely run untrusted repos (fake-interview malware, infostealers, RATs) in a locked-down, ephemeral container. No host secrets reachable, network denied by default, every egress attempt blocked and logged. Use meguard run <repo_url>, not a risky git clone plus npm install.
docker cli golang security sandbox static-analysis dynamic-analysis malware-analysis security-scanner devsecops container-security untrusted-code threat-detection supply-chain-security infostealer npm-security fake-interviews
-
Updated
Sep 18, 2026 - Go
Pre-install security for AI agents, npm packages, and MCP servers. Zero-dep local static analysis; normal scans never execute package code.
npm mcp static-analysis devsecops ai-agents supply-chain-security prompt-injection model-context-protocol mcp-security ai-agent-security npm-security
-
Updated
Nov 9, 2026 - JavaScript
Supply-chain malware scanner for Git repos. Finds droppers committed into the repo itself — the kind npm audit can't see because there's no malicious dependency. Runs on git clone or when VS Code opens the folder. Kills the loader, scans every repo you can reach, purges it from history.
nodejs macos linux npm security incident-response malware vscode infosec devsecops malware-detection malware-scanner threat-detection supply-chain-security github-security clipboard-stealer npm-security shai-hulud supply-chain-attack etherhiding
-
Updated
Nov 7, 2026 - Shell
Autonomous “Shai-Hulud” engine that ingests malicious NPM package advisories from OSV, tracks versions and metadata, and maintains a continuously updated threat intelligence database.
nodejs npm security automation infosec osv security-tools devsecops threat-intelligence malware-detection github-actions open-source-security supply-chain-security package-security npm-security shai-hulud shai-hulud-detector shai-hulud2-detector malicious-packages-db
-
Updated
Nov 10, 2026 - JavaScript
Local-first npm supply-chain security scanner: static + optional LLM analysis, CLI/CI gates, desktop app, and AI-agent skills.
desktop-app cli npm security typescript sqlite scanner static-analysis supply-chain developer-tools software-supply-chain devsecops ai-agents neutralinojs dependency-security llm package-security npm-security
-
Updated
Nov 7, 2026 - TypeScript
Offline, read-only repository triage for documented software supply-chain and coding-agent attacks, with explicit coverage and fail-closed results
python cli security software-supply-chain security-scanner sarif security-tools ai-security supply-chain-security developer-security coding-agents repository-scanner agent-security claude-code npm-security shai-hulud repository-security
-
Updated
Nov 8, 2026 - Python
Contained static file analysis with Claude Code and Codex: REA, Ghidra and JADX in restricted Docker containers, selected input copies, readable reports. Linux/macOS; Windows experimental.
windows macos linux docker security cross-platform mcp sandbox reverse-engineering posix software-supply-chain rea codex ai-agents prompt-injection model-context-protocol agent-security claude-code npm-security container-isolation
-
Updated
Oct 19, 2026 - Python
Supply-chain security scanner for npm packages. Detect malicious code, typosquatting, and compromised dependencies before you install them.
rust cli npm security tree-sitter static-analysis supply-chain developer-tools cve typosquatting sarif devsecops vulnerability-scanner malware-detection npm-audit package-security npm-security
-
Updated
Jun 29, 2026 - Rust
ClaudeRabbit is a free, open-source security product protecting the open-source community from malware. We clone any public GitHub repo into an isolated sandbox, run it, and return one honest safety score.
cli open-source security mcp sandbox ai-agents malware-detection supply-chain-security github-security npm-security
-
Updated
Oct 29, 2026 - TypeScript
DeepSeek Harness plugin that checks npm packages before install — 22 supply-chain rules, deep tarball scans, CI gates, local-first.
npm security ai sqlite scanner static-analysis supply-chain dsh security-scanner malware-detection dependency-security tool-plugin llm package-security deepseek agent-tools npm-security deepseek-harness dsh-plugin
-
Updated
Oct 31, 2026 - TypeScript
Defensive static analysis and detection engineering for the 2026 Shai-Hulud npm supply-chain campaign: Sigma/YARA rules, IOCs, ATT&CK mapping, and defender guidance.
ioc incident-response threat-hunting malware-analysis sigma yara devsecops threat-intelligence bun blue-team mitre-attack nodejs-security detection-engineering supply-chain-security ci-cd-security github-actions-security npm-security shai-hulud npm-supply-chain shai-hulud-2026
-
Updated
Aug 4, 2026 - YARA
Sentinel Package Manager blocks compromised packages BEFORE installation, preventing malicious code execution. Features: Pre-install blocking, command interception (npm/yarn/pnpm/bun), 795+ blacklist (Shai-Hulud), real-time checks (OSV/GitHub/Snyk), zero dependencies, auto-updates. Counters supply chain attacks.
npm security package-manager blacklist yarn pnpm security-tools bun vulnerability-scanner malware-detection zero-dependencies dependency-security supply-chain-security npm-security shai-hulud supply-chain-attack pre-install-validation package-validation npm-worm compromised-packages
-
Updated
Dec 2, 2025 - JavaScript
A security harness for AI coding agents. Supply chain, command scope, config integrity. Build specifications.
-
Updated
Aug 5, 2026 - Shell
Detect and clean up after the PolinRider supply-chain campaign: GitHub organizations, personal accounts and macOS, Linux and Windows machines. One binary, dry-run by default.
lazarus rust cli ioc incident-response dfir threat-hunting security-tools devsecops malware-detection malware-removal supply-chain-security github-security git-recovery npm-security supply-chain-attack contagious-interview polinrider beavertail force-push-recovery
-
Updated
Nov 9, 2026 - Rust
Add this topic to your repo
To associate your repository with the npm-security topic, visit your repo's landing page and select "manage topics."