npmscan: Malicious NPM Package Detection
npmscan helps software companies and development teams identify malicious code in dependencies. It is designed for teams needing a way to check packages without installing agents or granting repository access.
At a glance
- Category
- Security
- Best for
- Software Companies, Development Teams, Node.js Developers, Security Analysts
- Pricing
- npmscan is free to use for browser-based scanning.
- Key use cases
- Pre-Installation Sanity Checks, Detecting Crypto-Drainers, Supply Chain Risk Triage, Monitoring Malicious Behavior
- Official website
- npmscan.com
npmscan is a security scanner designed to detect malware-like behavior in NPM packages, such as crypto-drainers and obfuscated scripts. Unlike traditional vulnerability scanners that focus primarily on known CVEs, this tool uses lightweight static analysis to find patterns associated with supply chain attacks.
It is built for developers and security leads who need to verify the safety of a package or a dependency list. The tool is cloud-based, allowing users to paste a package name or a package.json file to receive a risk summary.
Because it does not require login, API keys, or repository access, it may be used as a triage tool before adding new dependencies to a project. Buyers should note that while it identifies behavioral risks, it is designed for analysis rather than full-scale enterprise policy management.
The service is designed to be privacy-first; it reads and analyzes the provided data and then forgets it, without storing source code.
Key Features
Scans for malware-like behavior, including crypto-drainers, obfuscation, and suspicious scripts.
Supports pasting a package.json or package name directly into the browser for scanning.
Analyzes metadata, scripts, and JS/TS files to identify behavior patterns associated with malicious code.
Uses an AI-driven database to track threat intelligence and supply chain attacks in real time.
Operates without the need for agents, onboarding, or account creation.
Analyzes packages without storing the source code or uploaded tarballs.
Use Cases
Verifying if a new NPM package or dependency set contains malicious code before adding it to a project.
Identifying packages designed to steal private keys or drain cryptocurrency wallets.
Screening package.json files for credential harvesting scripts or backdoor code.
Checking for suspicious postinstall hooks and inlined network calls to unknown endpoints.
Best For
Pricing
npmscan is free to use for browser-based scanning.
FAQ
It focuses on malware-like behavior, such as crypto-drainers, obfuscation, and suspicious scripts, rather than just known CVEs.
No, the tool is designed to work in the browser without requiring a login, API keys, or installation.
Yes, the browser-based scanning functionality is free to use.
The tool is designed to be privacy-first; it reads and analyzes the package and then forgets it without storing source code.
Source category: Security
Source subcategory: Vulnerability Management
