AI · alternatives · 2026
24 alternatives to NPMScan
Malicious npm package detection & security scanner
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1
Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
2022 · github.com · its alternatives →
- 2
- 3
Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
2025 · github.com · its alternatives →
- 4
Sandworm▲293Keep your JavaScript code secure and compliant with Sandworm
2023 · sandworm.dev · its alternatives →
- 5
Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
2022 · socket.dev · its alternatives →
- 6
- 7SW
2016 · npmdiscover.com · its alternatives →
- 8
DepsGuard▲10Configure once, prevent the next compromised package install
May 2026 · depsguard.com · its alternatives →
- 9
This past quarter has been awash with sophisticated npm supply chain attacks like [Shai-Hulud](https://www.cisa.gov/news-events/alerts/2025/09/23/widesprea...() and the [Chalk/debug Compromise](https://www.wiz.io/blog/widespread-npm-supply-chain-attack-b...). This CLI helps protect users from recently compromised packages by only downloading packages that have been public for a while (default is 90 days or older). Install: npm install -g @dendronhq/safe-npm Usage: safe-npm install react@^18 lodash How it works: - Queries…
Nov 2025 · github.com · its alternatives →
- 10
Monitor NuGet and NPM packages in your repositories
2021 · its alternatives →
- 11
Secure your JavaScript supply chain – block malware packages
2022 · socket.dev · its alternatives →
- 12
- 13
Snyk for GitHub▲143Fix vulnerabilities in Node & npm dependencies with a click.
2016 · snyk.io · its alternatives →
- 14
Did you know that VSCode extensions run with full access to your system—including file system, network, and credentials? Worse, dozens of malicious extensions have already made it into the marketplace, silently compromising devices. I am a security researcher and student developer who ran into this problem myself. To help tackle this, I built a 100% free tool (no login required) that scans VSCode (and Cursor/Windsurf) extensions for: - Hidden malware and obfuscated code - Dangerous permissions and API misuse - Vulnerable dependencies and suspicious network connections Users have already…
2025 · vscan.dev · its alternatives →
- 15
An open source security scanner for Visual Studio Code
2020 · snyk.io · its alternatives →
- 16
CodeScan▲16Scan and secure your code to prevent future cyber threats.
2025 · codescan.dev · its alternatives →
- 17
I noticed the growing security concerns around MCP (https://news.ycombinator.com/item?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations. MCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data. Example of what it detects: - Hidden instructions…
2025 · github.com · its alternatives →
- 18
EasyNPM▲108Search & install command with one-click for npm packages
2023 · easynpm.netlify.app · its alternatives →
- 19
If you are worried about the recent Lazarus group software supply chain attack, you should consider having guard rails that is more than conventional SCA. `vet` detects the package (version) published in the report as malware. Try out vet, its free and open source: https://github.com/safedep/vet More details on the attack: https://www.nodejs-security.com/blog/north-korea-malware-on-...
2023 · github.com · its alternatives →
- 20
Safescan▲73Anti money laundering and KYC analysis for a crypto address
2023 · cyberscope.io · its alternatives →
- 21
- 22
Online automated vulnerability scanner to secure firewalls, servers, web applications, and apis. Try 14 days for free.
2020 · hostedscan.com · its alternatives →
- 23
In light of the ongoing npm supply chain compromises, I built safe-install: https://www.npmjs.com/package/@gkiely/safe-install It brings a couple of protections I wanted from npm but are not built in. Similar to Bun’s trusted dependencies, it lets you disable install scripts by default and define a list of dependencies that are allowed to run build/install scripts: https://bun.com/docs/guides/install/trusted It also supports blocking exotic sub-dependencies, similar to pnpm’s `blockExoticSubdeps` setting:…
May 2026 · npmjs.com · its alternatives →
- 24
I recently came across an amazing post that really emphasizes the dangers associated with installing npm packages. It seems that every week a new supply chain attack occurs. In my opinion, the existing solutions for this don't quite cut it so I decided to create a library which provides runtime protection for Node. It currently protects against: - Unauthorized file system access - Unauthorized network access - Unauthorized command execution - (by way of exec/spawn) I just released the first beta version of the library and I'd love to hear what you guys think. Note: Protection is still…
2022 · github.com · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →