{"_id":"@araptus/npm-security-scanner","_rev":"5-ca865634de9e16121e838896b6c3952d","name":"@araptus/npm-security-scanner","dist-tags":{"latest":"2.0.2"},"versions":{"1.2.0":{"name":"@araptus/npm-security-scanner","version":"1.2.0","keywords":["security","npm","scanner","malware","supply-chain","shai-hulud","cli","audit","dependencies","vulnerability"],"author":{"name":"Kris Araptus"},"license":"MIT","_id":"@araptus/npm-security-scanner@1.2.0","maintainers":[{"name":"kb.araptus","email":"kris@araptus.com"}],"homepage":"https://github.com/araptus/npm-security-scanner#readme","bugs":{"url":"https://github.com/araptus/npm-security-scanner/issues"},"bin":{"security-scan":"scripts/security-scan.js","security-scan-all":"scripts/scan-all.js"},"dist":{"shasum":"c7cc7ba7a5d3ac12be0472509cca5406f651d721","tarball":"https://registry.npmjs.org/@araptus/npm-security-scanner/-/npm-security-scanner-1.2.0.tgz","fileCount":8,"integrity":"sha512-j4d6Fj8SBPt8Y8zUSOciDT8IJqhB0wXPRsc2Y168hhk6xB/oCzQ9LUOSmaCutrTWF6OhKRIeH4lB7sMJAAfYSg==","signatures":[{"sig":"MEUCIDE+6aovIAz3xvj0b1BFI6z2olQrNfqhgAC6efwZyXkaAiEAh6lk2yBZNWZrE9HxuHBNNyZCU+Y9KeiisaNsUFbtAX0=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":79078},"main":"scripts/security-scan.js","engines":{"node":">=18.0.0"},"gitHead":"7faeaf23a0c00718604badd9b727a67e4995805f","scripts":{"test":"node --test tests/security-scan.test.js","test:scan":"node scripts/security-scan.js --verbose","test:verbose":"node --test --test-reporter spec tests/security-scan.test.js","security:full":"pnpm audit; pnpm outdated || true; node scripts/security-scan.js --verbose","security:scan":"node scripts/security-scan.js","security:audit":"pnpm audit --prod && node scripts/security-scan.js","security:scan:all":"node scripts/scan-all.js --from-list","security:scan:dir":"node scripts/scan-all.js","security:scan:deep":"node scripts/security-scan.js --deep","security:scan:json":"node scripts/security-scan.js --json","security:scan:report":"node scripts/security-scan.js --report","security:scan:strict":"node scripts/security-scan.js --strict","security:scan:verbose":"node scripts/security-scan.js --verbose"},"_npmUser":{"name":"kb.araptus","email":"kris@araptus.com"},"repository":{"url":"git+https://github.com/araptus/npm-security-scanner.git","type":"git"},"_npmVersion":"11.5.2","description":"A fast, configurable CLI tool that scans your dependencies against a continuously-updated database of known compromised npm packages","directories":{},"_nodeVersion":"22.16.0","dependencies":{},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.9.3","@types/node":"24.10.2"},"_npmOperationalInternal":{"tmp":"tmp/npm-security-scanner_1.2.0_1765511486211_0.7278893884946678","host":"s3://npm-registry-packages-npm-production"}},"1.2.1":{"name":"@araptus/npm-security-scanner","version":"1.2.1","keywords":["security","npm","scanner","malware","supply-chain","shai-hulud","cli","audit","dependencies","vulnerability"],"author":{"name":"Kris Araptus"},"license":"MIT","_id":"@araptus/npm-security-scanner@1.2.1","maintainers":[{"name":"kb.araptus","email":"kris@araptus.com"}],"homepage":"https://araptus.com","bugs":{"url":"https://github.com/araptus/npm-security-scanner/issues"},"bin":{"security-scan":"scripts/security-scan.js","security-scan-all":"scripts/scan-all.js"},"dist":{"shasum":"6e8ba22c2d3a6740b2bed79eb59993c6a042f92d","tarball":"https://registry.npmjs.org/@araptus/npm-security-scanner/-/npm-security-scanner-1.2.1.tgz","fileCount":8,"integrity":"sha512-VJvhlY8Zex0CELktYzSxt5lL+i3kLKgEORg8R/ShrZeyNfTN67AFrBWQGgvXw5vil7ILJWbpzNw1Sx0r6WEBwg==","signatures":[{"sig":"MEUCIH8jeiG04RSRHg8Q9K7fdnNz7Nn/W+/a86pl/qYXr1SnAiEA+jKH58EMenKYlMzxcaIEoWrNYru76diu/NrQ398SSwI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":79040},"main":"scripts/security-scan.js","engines":{"node":">=18.0.0"},"gitHead":"b49b3651922976f7f946d8e0501e6171c2b8bc32","scripts":{"test":"node --test tests/security-scan.test.js","test:scan":"node scripts/security-scan.js --verbose","test:verbose":"node --test --test-reporter spec tests/security-scan.test.js","security:full":"pnpm audit; pnpm outdated || true; node scripts/security-scan.js --verbose","security:scan":"node scripts/security-scan.js","security:audit":"pnpm audit --prod && node scripts/security-scan.js","security:scan:all":"node scripts/scan-all.js --from-list","security:scan:dir":"node scripts/scan-all.js","security:scan:deep":"node scripts/security-scan.js --deep","security:scan:json":"node scripts/security-scan.js --json","security:scan:report":"node scripts/security-scan.js --report","security:scan:strict":"node scripts/security-scan.js --strict","security:scan:verbose":"node scripts/security-scan.js --verbose"},"_npmUser":{"name":"kb.araptus","email":"kris@araptus.com"},"repository":{"url":"git+https://github.com/araptus/npm-security-scanner.git","type":"git"},"_npmVersion":"11.5.2","description":"A fast, configurable CLI tool that scans your dependencies against a continuously-updated database of known compromised npm packages","directories":{},"_nodeVersion":"22.16.0","dependencies":{},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.9.3","@types/node":"25.0.1"},"_npmOperationalInternal":{"tmp":"tmp/npm-security-scanner_1.2.1_1765512539961_0.6078642917310546","host":"s3://npm-registry-packages-npm-production"}},"2.0.0":{"name":"@araptus/npm-security-scanner","version":"2.0.0","keywords":["security","npm","scanner","malware","supply-chain","shai-hulud","cli","audit","dependencies","vulnerability"],"author":{"name":"Kris Araptus"},"license":"MIT","_id":"@araptus/npm-security-scanner@2.0.0","maintainers":[{"name":"kb.araptus","email":"kris@araptus.com"}],"homepage":"https://araptus.com","bugs":{"url":"https://github.com/araptus/npm-security-scanner/issues"},"bin":{"security-scan":"scripts/security-scan.js","security-scan-all":"scripts/scan-all.js"},"dist":{"shasum":"429001ac815db98b346713d561bb648f8c17bc87","tarball":"https://registry.npmjs.org/@araptus/npm-security-scanner/-/npm-security-scanner-2.0.0.tgz","fileCount":9,"integrity":"sha512-jkZINCnW1u6gstDl6tEIUnCe2uhMPyXebY/8l2G6KDq6vJbnyW30iKXql88eOoKnJotueVsvo/YGD0OCSB6E/w==","signatures":[{"sig":"MEYCIQDc7KPdOnnWp5HHR5vBC46u1oWfYME1VkSTdrgePK7NiAIhAO7OMYhYDq1TRwcPSBQfFhmS9GgNIAZxrffYScMxrud/","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":104246},"main":"scripts/security-scan.js","engines":{"node":">=18.0.0"},"gitHead":"5a403afd6ba142157d8b7d78e5f07cd79d2a7528","scripts":{"test":"node --test tests/security-scan.test.js","test:scan":"node scripts/security-scan.js --verbose","test:verbose":"node --test --test-reporter spec tests/security-scan.test.js","security:full":"pnpm audit; pnpm outdated || true; node scripts/security-scan.js --deep --verbose","security:scan":"node scripts/security-scan.js","security:audit":"pnpm audit --prod && node scripts/security-scan.js --deep","security:scan:all":"node scripts/scan-all.js --from-list","security:scan:dir":"node scripts/scan-all.js","security:scan:deep":"node scripts/security-scan.js --deep","security:scan:json":"node scripts/security-scan.js --json","security:scan:report":"node scripts/security-scan.js --report","security:scan:strict":"node scripts/security-scan.js --strict","security:scan:verbose":"node scripts/security-scan.js --verbose","security:scan:deep:strict":"node scripts/security-scan.js --deep --strict","security:scan:deep:verbose":"node scripts/security-scan.js --deep --verbose"},"_npmUser":{"name":"kb.araptus","email":"kris@araptus.com"},"repository":{"url":"git+https://github.com/araptus/npm-security-scanner.git","type":"git"},"_npmVersion":"11.5.2","description":"A fast, configurable CLI tool that scans your dependencies against a continuously-updated database of known compromised npm packages. Supports deep scanning of transitive dependencies via lock files.","directories":{},"_nodeVersion":"22.16.0","dependencies":{},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.9.3","@types/node":"25.0.2"},"_npmOperationalInternal":{"tmp":"tmp/npm-security-scanner_2.0.0_1765863712687_0.3735706316739147","host":"s3://npm-registry-packages-npm-production"}},"2.0.1":{"name":"@araptus/npm-security-scanner","version":"2.0.1","keywords":["security","npm","scanner","malware","supply-chain","shai-hulud","cli","audit","dependencies","vulnerability"],"author":{"name":"Kris Araptus"},"license":"MIT","_id":"@araptus/npm-security-scanner@2.0.1","maintainers":[{"name":"kb.araptus","email":"kris@araptus.com"}],"homepage":"https://araptus.com","bugs":{"url":"https://github.com/araptus/npm-security-scanner/issues"},"bin":{"security-scan":"scripts/security-scan.js","security-scan-all":"scripts/scan-all.js"},"dist":{"shasum":"7bf19919a28826b14c4f97093771cf33c74320b1","tarball":"https://registry.npmjs.org/@araptus/npm-security-scanner/-/npm-security-scanner-2.0.1.tgz","fileCount":9,"integrity":"sha512-QqYUPf6XazfqFoik2wWA3MBXehVDsZzxfQsarjMPa6aSN+QFo/ei9tRmUfe/TMSn6JJsfXSQazwjbLhiTwk6Aw==","signatures":[{"sig":"MEUCIQCfwvrYtsKUXxsEDIJCuqLTX9MFt0X5cfzwlGi+4+swhwIgdVqA3hjnzr/4w/TcJIHiPP0QgIvQM27SJ5orbXVTR8o=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":104924},"main":"scripts/security-scan.js","engines":{"node":">=18.0.0"},"gitHead":"9d0b5923686544e987447d557f8246896d88f7bc","scripts":{"test":"node --test tests/security-scan.test.js","test:scan":"node scripts/security-scan.js --verbose","test:verbose":"node --test --test-reporter spec tests/security-scan.test.js","security:full":"pnpm audit; pnpm outdated || true; node scripts/security-scan.js --deep --verbose","security:scan":"node scripts/security-scan.js","security:audit":"pnpm audit --prod && node scripts/security-scan.js --deep","security:scan:all":"node scripts/scan-all.js --from-list","security:scan:dir":"node scripts/scan-all.js","security:scan:deep":"node scripts/security-scan.js --deep","security:scan:json":"node scripts/security-scan.js --json","security:scan:report":"node scripts/security-scan.js --report","security:scan:strict":"node scripts/security-scan.js --strict","security:scan:verbose":"node scripts/security-scan.js --verbose","security:scan:deep:strict":"node scripts/security-scan.js --deep --strict","security:scan:deep:verbose":"node scripts/security-scan.js --deep --verbose"},"_npmUser":{"name":"kb.araptus","email":"kris@araptus.com"},"repository":{"url":"git+https://github.com/araptus/npm-security-scanner.git","type":"git"},"_npmVersion":"11.5.2","description":"A fast, configurable CLI tool that scans your dependencies against a continuously-updated database of known compromised npm packages. Supports deep scanning of transitive dependencies via lock files.","directories":{},"_nodeVersion":"22.16.0","dependencies":{},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.9.3","@types/node":"25.0.3"},"_npmOperationalInternal":{"tmp":"tmp/npm-security-scanner_2.0.1_1765939614930_0.016355359535622727","host":"s3://npm-registry-packages-npm-production"}},"2.0.2":{"name":"@araptus/npm-security-scanner","version":"2.0.2","description":"A fast, configurable CLI tool that scans your dependencies against a continuously-updated database of known compromised npm packages. Supports deep scanning of transitive dependencies via lock files.","main":"scripts/security-scan.js","bin":{"security-scan":"scripts/security-scan.js","security-scan-all":"scripts/scan-all.js"},"scripts":{"security:scan":"node scripts/security-scan.js","security:scan:verbose":"node scripts/security-scan.js --verbose","security:scan:json":"node scripts/security-scan.js --json","security:scan:strict":"node scripts/security-scan.js --strict","security:scan:deep":"node scripts/security-scan.js --deep","security:scan:deep:verbose":"node scripts/security-scan.js --deep --verbose","security:scan:deep:strict":"node scripts/security-scan.js --deep --strict","security:scan:report":"node scripts/security-scan.js --report","security:scan:all":"node scripts/scan-all.js --from-list","security:scan:dir":"node scripts/scan-all.js","security:audit":"pnpm audit --prod && node scripts/security-scan.js --deep","security:full":"pnpm audit; pnpm outdated || true; node scripts/security-scan.js --deep --verbose","test":"node --test tests/security-scan.test.js","test:verbose":"node --test --test-reporter spec tests/security-scan.test.js","test:scan":"node scripts/security-scan.js --verbose"},"dependencies":{},"devDependencies":{"@types/node":"25.0.3","typescript":"^5.9.3"},"keywords":["security","npm","scanner","malware","supply-chain","shai-hulud","cli","audit","dependencies","vulnerability"],"author":{"name":"Kris Araptus"},"license":"MIT","engines":{"node":">=18.0.0"},"repository":{"type":"git","url":"git+https://github.com/araptus/npm-security-scanner.git"},"bugs":{"url":"https://github.com/araptus/npm-security-scanner/issues"},"homepage":"https://araptus.com","_id":"@araptus/npm-security-scanner@2.0.2","gitHead":"5b517f3e730aa1a589b2c0d635547887c56b3192","_nodeVersion":"22.16.0","_npmVersion":"11.5.2","dist":{"integrity":"sha512-0fL/3pqEJ8tfl6WSbKZihSd6ZdOp0yeJ60b/PDtUikcVuj8o2+FusrS6C23TJh2oXluwYWbmIirga5m1yt36pg==","shasum":"5a6f987c58c50795692405567ae45d20cf22f841","tarball":"https://registry.npmjs.org/@araptus/npm-security-scanner/-/npm-security-scanner-2.0.2.tgz","fileCount":9,"unpackedSize":111001,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQDP+GilNPOt/t7U6RYG7B1C5TNHL6b+J3EW80WP9UyYBAIgEnFksGhA7riI3OkrlLbMjT8ABwoE5a7nHg2xjMtOg+8="}]},"_npmUser":{"name":"kb.araptus","email":"kris@araptus.com"},"directories":{},"maintainers":[{"name":"kb.araptus","email":"kris@araptus.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/npm-security-scanner_2.0.2_1766361077737_0.604549884795593"},"_hasShrinkwrap":false}},"time":{"created":"2025-12-12T03:51:26.098Z","modified":"2025-12-21T23:51:18.100Z","1.2.0":"2025-12-12T03:51:26.353Z","1.2.1":"2025-12-12T04:09:00.130Z","2.0.0":"2025-12-16T05:41:52.849Z","2.0.1":"2025-12-17T02:46:55.062Z","2.0.2":"2025-12-21T23:51:17.883Z"},"bugs":{"url":"https://github.com/araptus/npm-security-scanner/issues"},"author":{"name":"Kris Araptus"},"license":"MIT","homepage":"https://araptus.com","keywords":["security","npm","scanner","malware","supply-chain","shai-hulud","cli","audit","dependencies","vulnerability"],"repository":{"type":"git","url":"git+https://github.com/araptus/npm-security-scanner.git"},"description":"A fast, configurable CLI tool that scans your dependencies against a continuously-updated database of known compromised npm packages. Supports deep scanning of transitive dependencies via lock files.","maintainers":[{"name":"kb.araptus","email":"kris@araptus.com"}],"readme":"# PNPM Security Scanner\n\nDetect compromised npm packages in your Node.js projects.\n\nA fast, zero-dependency CLI tool that scans your dependencies against a database of known malicious packages. Works with **npm**, **pnpm**, and **yarn** — any project with a `package.json`.\n\n> **Inspired by the [Shai-Hulud npm worm](https://socket.dev/blog/shai-hulud-npm-worm)** — a self-replicating malware that infected 700+ packages with 2M+ weekly downloads. Resurged in November 2025 affecting 19,000+ GitHub repos.\n\n\n## Quick Start\n\n```bash\n# Clone or copy to your project\ngit clone https://github.com/araptus/npm-security-scanner.git\ncd npm-security-scanner\n\n# Install (optional - zero dependencies for core scanner)\npnpm install\n\n# Run\nnode scripts/security-scan.js\n```\n\nOr copy the scanner into an existing project:\n\n```bash\ncp scripts/security-scan.js your-project/scripts/\ncp -r security/ your-project/security/\n```\n\nAdd to `package.json`:\n\n```json\n{\n  \"scripts\": {\n    \"security:scan\": \"node scripts/security-scan.js\"\n  }\n}\n```\n\n---\n\n## Usage\n\n```bash\n# Quick scan (direct dependencies only)\npnpm run security:scan\n\n# Deep scan (all transitive dependencies via lock file)\npnpm run security:scan --deep\n\n# Detailed output\npnpm run security:scan --verbose\n\n# Check postinstall scripts for suspicious patterns\npnpm run security:scan -- --analyze-scripts\n\n# Generate HTML report\npnpm run security:scan -- --report\n\n# JSON output (for CI/CD pipelines)\npnpm run security:scan -- --json\n\n# Ignore specific packages\npnpm run security:scan -- --ignore pkg1,pkg2\n\n# Strict mode (fail on any risk)\npnpm run security:scan --strict\n\n# Combine flags\npnpm run security:scan --deep --strict --json\n\n# Auto-fix (remove malicious packages)\npnpm run security:scan -- --fix --yes\n```\n\n---\n\n## CLI Options\n\n| Option | Description |\n|--------|-------------|\n| `--verbose, -v` | Show detailed output |\n| `--deep` | Scan transitive dependencies (node_modules) |\n| `--analyze-scripts` | Check postinstall scripts for suspicious patterns |\n| `--strict` | Fail on any risk level |\n| `--json` | JSON output for parsing |\n| `--silent, -s` | Suppress output (exit code only) |\n| `--report` | Generate `security-report.html` |\n| `--ignore <pkgs>` | Comma-separated packages to skip |\n| `--fix` | Remove malicious packages |\n| `--yes, -y` | Auto-confirm --fix |\n| `--version, -V` | Show version |\n\n---\n\n## Multi-Project Scanning\n\nScan multiple Node.js projects at once using `scan-all.js`.\n\n### Scan a Directory\n\n```bash\n# Scan all projects in ~/Software\nnode scripts/scan-all.js ~/Software\n\n# Limit search depth\nnode scripts/scan-all.js ~/code --depth 2\n\n# Parallel scanning (faster for many projects)\nnode scripts/scan-all.js ~/projects --parallel\n```\n\n### Manage a Projects List\n\nBuild a reusable list of projects to scan regularly:\n\n```bash\n# Add all projects from a directory\nnode scripts/scan-all.js --add-all ~/Software\n\n# Or add individual projects\nnode scripts/scan-all.js --add ~/projects/app-1\nnode scripts/scan-all.js --add ~/projects/app-2\n\n# View your list\nnode scripts/scan-all.js --show-list\n\n# Remove a project\nnode scripts/scan-all.js --remove ~/projects/old-app\n\n# Scan from saved list\nnode scripts/scan-all.js --from-list\n```\n\n**List location priority:**\n1. `./projects.json` (local, in current directory)\n2. `~/.security-scan-projects.json` (global fallback)\n\n### Example Output\n\n```\n🔍 Scanning projects from list...\nProjects: 53\n\n  ✓ Clean project-a\n  ✓ Clean project-b\n  ✗ 2 issues project-c (1 critical, 1 high)\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  📊 SUMMARY\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  Projects scanned:  53\n  Clean:             52\n  With issues:       1\n  Packages scanned:  1518\n```\n\n---\n\n## Configuration\n\nCreate a `.securityscanrc.json` file in your project root for persistent settings:\n\n```json\n{\n  \"ignore\": [\"package-to-skip\"],\n  \"failOn\": [\"critical\", \"high\"],\n  \"scanDeep\": false,\n  \"analyzeScripts\": false,\n  \"trustedPackages\": [\"@my-org/*\"],\n  \"verbose\": false,\n  \"strict\": false\n}\n```\n\n| Option | Type | Description |\n|--------|------|-------------|\n| `ignore` | `string[]` | Packages to skip during scan |\n| `failOn` | `string[]` | Severity levels that cause exit code 1 |\n| `scanDeep` | `boolean` | Scan transitive dependencies |\n| `analyzeScripts` | `boolean` | Check postinstall scripts |\n| `trustedPackages` | `string[]` | Glob patterns for trusted packages |\n| `verbose` | `boolean` | Detailed output |\n| `strict` | `boolean` | Fail on any risk level |\n\n---\n\n## What It Detects\n\n- **159+ known malicious packages** — confirmed threats from npm advisories\n- **7 major 2025 attack campaigns** — Shai-Hulud, Chalk Phishing, PhantomRaven, Gluestack RAT, and more\n- **Version-specific compromises** — only flags affected versions, not entire packages\n- **Typosquatting variants** (75 packages) — common misspellings of popular packages\n- **Credential theft packages** (25 packages) — packages designed to steal tokens and keys\n- **Crypto mining malware** (13 packages) — hidden miners in dependencies\n- **Suspicious postinstall scripts** — detects eval, network calls, obfuscation\n\n---\n\n## Deep Scanning\n\nUse `--deep` to scan **transitive dependencies** from your lock file. This is where most supply chain attacks hide.\n\n```bash\npnpm run security:scan --deep\n```\n\nSupported lock files:\n- `pnpm-lock.yaml` (pnpm)\n- `package-lock.json` (npm)\n- `yarn.lock` (yarn)\n\n---\n\n## CI/CD Integration\n\n### GitHub Actions\n\n```yaml\nname: Security Scan\non: [push, pull_request]\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - run: npx @araptus/npm-security-scanner --deep --strict\n```\n\n### Exit Codes\n\n| Code | Meaning |\n|------|---------|\n| `0` | Clean — no issues found |\n| `1` | Issues found — malicious packages detected |\n| `2` | Error — configuration or runtime error |\n\nUse in CI/CD:\n\n```yaml\n- run: node scripts/security-scan.js --json\n  continue-on-error: false\n```\n\n---\n\n## Web UI (Stakeholder Reports)\n\nA browser-based interface for scanning dependencies — perfect for demos, stakeholder presentations, or non-technical team members.\n\n### Quick Start\n\n```bash\ncd web\npnpm install\npnpm dev\n```\n\nOpen [http://localhost:4321](http://localhost:4321) in your browser.\n\n### Features\n\n- **Drag & drop** — Upload `package.json` or lock files directly\n- **Paste support** — Copy/paste file contents for quick scans\n- **Deep scanning** — Automatically detects and parses lock files\n- **Visual reports** — Color-coded severity levels, dependency chains\n- **One-click remediation** — Copy removal commands for npm/pnpm/yarn\n- **Campaign tracking** — See which attack campaigns affect your deps\n\n### Build for Production\n\n```bash\ncd web\npnpm build\npnpm preview\n```\n\nThe web UI is built with **Astro**, **React**, and **Tailwind CSS**. Deploys to Vercel out of the box.\n\n---\n\n## Threat Database\n\nThe threat database is at `security/compromised-packages.json`. It includes:\n\n- `knownMalicious.confirmed` — packages confirmed as malicious\n- `knownMalicious.versionSpecific` — legitimate packages with compromised versions (e.g., chalk 5.6.1)\n- `knownMalicious.typosquatting` — typosquatting variants\n- `knownMalicious.credentialTheft` — token/credential stealers\n- `knownMalicious.cryptoMalware` — crypto mining packages\n- `campaigns` — 7 coordinated attack campaigns with affected versions\n- `trustedPackages` — allowlist of known-safe packages\n\n### Update the Database\n\n```bash\n# Manual update\n# Edit security/compromised-packages.json\n\n# Or check for updates online\n# (coming soon: --update flag)\n```\n\n---\n\n## Project Structure\n\n```\n├── scripts/\n│   ├── security-scan.js         # Main scanner CLI (zero dependencies)\n│   └── scan-all.js              # Multi-project batch scanner\n├── security/\n│   ├── compromised-packages.json  # Threat database (159+ packages, 7 campaigns)\n│   └── README.md                # Quick start guide\n├── tests/\n│   └── security-scan.test.js    # Unit tests\n├── web/                         # Web UI (Astro + React + Tailwind)\n│   ├── src/\n│   │   ├── components/          # React components (Scanner.tsx)\n│   │   ├── lib/                 # Scanner logic + threat DB\n│   │   └── pages/               # Astro pages + API endpoints\n│   └── package.json\n├── .securityscanrc.json         # Your config (create from example)\n├── projects.json                # Your projects list (for scan-all.js)\n└── package.json\n```\n\n---\n\n## Credits\n\n- **Kris Araptus** — Original scanner and threat database\n- **Jeremiah Coakley / FEDLIN** — Deep scanning\n\n---\n\n## License\n\nMIT\n","readmeFilename":"README.md"}