cryptostrapon /
Project URL Category JS Project Title A zero dependency Node script that flags install hooks and risky code in a repo before your first npm install Project Description Run it on a repo you did not write, like a take-home…
Project URL Category JS Project Title A zero dependency Node script that flags install hooks and risky code in a repo before your first npm install Project Description Run it on a repo you did not write, like a take-home test from a recruiter, before npm install. It lists preinstall, install, postinstall and prepare hooks and flags shell execution, runtime base64 decoding, curl pipes and credential paths. Highlights One file, no dependencies, no network access, read only: it never runs the code it checks. Built for a real attack: fake recruiter take-home repos that hide the payload in an install hook. Clear exit codes (1 flagged, 0 clean, 2 unreadable) and a self test, easy to drop into CI. Honest about limits: a clean result is not proof of safety, and the README says what it cannot catch. MIT licensed. Good first issues are open (JSON output, TypeScript files, git URL dependencies). Example Code markdown curl -O node audit.js ./take-home-task ! package.json: postinstall hook runs: node scripts/setup.js ! scripts/setup.js: runs shell commands ! scripts/setup.js: decodes base64 at runtime ! scripts/setup.js: pipes a download into a shell 4 finding(s). Read them before you run npm install. Screenshots or Demo Videos
Discuss this product