NPMScan
Malicious npm package detection & security scanner
NPMScan launched on October 21, 2025 with 1 votes. The site was still online in September 2026, 1 year on.
What it does
Protect your Node.js projects from supply chain attacks. Scan npm packages for malware, crypto-drainers, and security vulnerabilities. Real-time threat intelligence database tracking malicious packages.
$2.8 BILLION stolen through malicious npm packages. Don't be the next victim. Scan before you install. Different tools solve different security problems. npmscan focuses on malware-like behavior — drainers, obfuscation and sketchy scripts — not just known CVEs. No agents, no repo access, no onboarding. Open npmscan, paste your package.json or package name, and get a focused view on malware-style risks in seconds. npmscan performs lightweight static analysis on npm packages and dependency lists to surface behavior patterns associated with malicious code. Your package stays your package — npmscan reads it, analyzes it, and forgets it. Known malicious packages that have compromised production…from npmscan.com
Does a similar job
all alternatives →
npm install actual-malware2022 · github.com · ▲55Our package registry ecosystem has a serious problem... and not just npm. People are aware of this but maybe this will make them a bit more aware
Tips to stay safe from NPM supply chain attacks2025 · github.com · ▲96Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!
Socket – Secure your JavaScript supply chain2022 · socket.dev · ▲133Excited to share the project I've been working on for the past 7 months! We've seen nearly weekly attacks against the open source software supply chain. I saw the seeds of this trend start in the mid 2015s as an open source maintainer and I've watched it only get worse over the years. I finally decided to try to solve this problem. Socket is taking an entirely new approach to one of the hardest problems in security in a stagnant part of the industry that has historically been obsessed with just reporting on known vulnerabilities. Unlike other scanning tools, Socket actually analyzes the…
More ai this month
the category →
Paintings by AI models: programs run through a simulation of oil paint.
AI · 20d ago · stillwet.art
PixVerse R2▲381A real-time world model you can explore and change
AI · 29d ago · world.pixverse.video
Source: Product Hunt launch ↗
Launched alongside, October 2025
the whole month →
I went down the rabbit hole on a side project and ended up building this: Strange Attractors(https://blog.shashanktomar.com/posts/strange-attractors). It’s built with three.js. Working on it reminded me of the little "maths for fun" exercises I used to do while learning programming in early days. Just trying things out, getting fascinated and geeky, and being surprised by the results. I spent way too much time on this, but it was extreme fun. My favorite part: someone pointed me to the Simone Attractor on Threads. It is a 2D attractor and I asked GPT to extrapolate it to…
AI · Oct 2025 · blog.shashanktomar.com
Autism Simulator▲779Hey all, I built this. It’s not trying to capture every autistic experience (that’d be impossible). It’s based on my own lived experience as well as that of friends on the spectrum. I'm trying to give people a feel for what masking, decision fatigue, and burnout can look like day-to-day. That’s hard to explain in words, but easier to show through choices and stats. I'm not trying to "define autism". I’ve gotten good feedback here about resilience, meds, and difficulty tuning. I’ll keep tweaking it. If even a few people walk away thinking, "ah, maybe that’s why my coworker struggles in those…
Life & fun · 2025 · autism-simulator.vercel.app
