npm-compromise-scanner is a CLI tool that scans a project’s manifests and lockfiles for known compromised npm package versions. It can also be configured to scan against a custom advisory.

Why?

Since the first occurrence of the shai-hulud incident, the number of npm packages that have been compromised has been steadily increasing.
Everytime a new incident was reported, I found myself scanning my local machine for affected versions of packages I had installed.
With the latest incident reported by the Aikido team, I decided to create a re-usable cli tool that can be used to scan a project’s manifests and lockfiles for known compromised npm package versions.

How it works

The scanner uses a list of known compromised npm package versions and scans your computer (or which ever directory you specify) for package.json and lockfiles. It then checks the dependencies against the list of known compromised versions and reports any matches. The list of compromised versions is maintained in a JSON file, which you can also create interactively by running the scanner with the init command and specifying a custom advisory source.

Basic Usage

Find known compromised npm package versions in a project’s manifests and lockfiles.

  npx @eimerreis/npm-compromise-scanner --root /path/to/project

Made for agentic use

The help command is designed to give agents all the information they need to run the scanner without any human intervention. So at the next incident, you can basically prompt your agent:

Use `@eimerreis/npm-compromise-scanner` to scan my machine for compromised packages from https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack

npm Compromise Scanner

  npx @eimerreis/npm-compromise-scanner --root /path/to/project

• Scans package.json plus npm, Yarn, pnpm, and Bun lockfiles.
• Exit code 0: no configured compromised versions found.
• Exit code 1: compromised version found.

To scan against a custom advisory:

  npx @eimerreis/npm-compromise-scanner init \
    --source https://example.com/security-advisory \
    --package affected-package@1.2.3

This creates npm-compromise-scanner.json in the current directory. Run the scanner from that directory to use it automatically:

  npx @eimerreis/npm-compromise-scanner --root /path/to/project

Add multiple affected versions/packages by repeating --package.

Interactive custom advisory setup

Instead of supplying packages on the command line, run:

  npx @eimerreis/npm-compromise-scanner init

It asks for:

• Advisory source URL
• Compromised package name
• Exact compromised version(s)
• Additional packages, if needed

It writes npm-compromise-scanner.json in the current directory. Then scan a project with that local advisory:

  npx @eimerreis/npm-compromise-scanner --root /path/to/project